The short answer
Small Utility Cybersecurity Priorities
A small water or wastewater utility removes most of its cyber risk with ten measures: know what is connected, get every control device off the internet, remove default and shared passwords, put multi-factor authentication on remote access, back up the controller programs and SCADA offline and test a restore, keep the ability to run manually, separate the control network from the office network, keep vendor access under utility control, log in with named accounts, and write down who to call. None requires a security team; all require someone to own them.
Key points
- Ten measures, in order. The first five take a week and remove most of the exposure.
- An internet-reachable PLC or HMI is the single worst finding. Fix it first, today.
- Backups that have never been restored are not backups.
- Manual operation is a security control. Practice it.
- Every measure needs an owner and a date, not a policy document.
Why small utilities first
The publicly reported incidents at water systems have disproportionately involved small utilities: a plant with a remote access tool and a shared password, a system with an HMI reachable from the internet, a utility whose SCADA was ransomed with no offline backup. Small utilities are not targeted because they are valuable; they are found because they are reachable, by scans that cover the whole internet and try the defaults. The defenses that stop those attacks are cheap, and the reason they are missing is that nobody owned them, not that nobody could afford them.
This page is the order of work for a utility with one to a handful of operators, no IT staff, and a contractor or an integrator on call. Each measure names what it prevents, roughly what it costs, and how to know it is finished.
The ten
- 1
Know what is connected
Walk every panel and list every device with a network cable, a radio, or a modem: controllers, HMIs, switches, radios, cellular modems, cameras, remote access boxes. Follow every cable that leaves a control switch. Cost: a day with a clipboard. Done when: a list exists with the device, its location, its address, and who put it there.
- 2
Get everything off the internet
Check every device on the list for a path to the internet: a public IP, a port forward on the office router, a cellular modem with a public address, a remote access tool that calls out. Remove each one. Cost: hours, plus a router configuration. Done when: an external scan of the utility public addresses finds no control devices, and every remote access path is one the utility deliberately built.
- 3
Remove default and shared passwords
Every device on the list, every SCADA account, every remote tool. Unique per device, recorded in a password manager the utility controls. Cost: a few days. Done when: no device answers to the manual default and no account is shared by name.
- 4
Multi-factor authentication on every remote path
The VPN, the remote desktop gateway, the SCADA mobile application, the vendor access. Cost: a VPN or a gateway that supports it, often already owned, and an authenticator on each phone. Done when: no one can reach the control system from outside with only a password.
- 5
Back up and test a restore
Controller programs with firmware versions, SCADA project and historian, drive parameters, network device configurations, to an external drive kept unplugged and a second copy off site. Restore one controller program to a spare and one SCADA project to a test machine. Cost: a drive, a day, an annual repeat. Done when: the restore worked and the date is written down.
- 6
Keep the plant running by hand
Confirm the pumps run in HAND, the chemical feeds have manual settings, the lift stations pump on floats, and the operators have done it recently. Write the procedure. Cost: an exercise on a quiet day. Done when: the utility has run for a shift without SCADA on purpose.
- 7
Separate control from office
The SCADA server, the HMIs, and the controllers on their own network or VLAN with a firewall between them and the office computers that browse and receive email. Cost: a firewall and a day of an integrator or a contractor. Done when: an office computer cannot reach a controller address.
- 8
Control vendor access
No standing vendor connection. A utility employee turns access on for a session and off after, through the MFA path. Vendor-installed modems removed. Cost: a conversation with each vendor and a contract clause. Done when: the utility can name every way a vendor can connect and each one is off by default.
- 9
Named accounts and logs
Every person has their own SCADA and Windows account; the operator account is not shared; logins and changes are logged and the log is kept. Cost: SCADA configuration. Done when: an action in the system can be traced to a person.
- 10
Write down who to call
A one-page plan: who decides to disconnect, who runs the plant by hand, who to call at the state, at the vendor, at the integrator, and at the agencies that help utilities, with phone numbers, on paper, in the control room. Cost: an afternoon. Done when: the page exists and the people on it know they are on it.
What each one prevents
| Measure | Prevents | The incident it comes from |
|---|---|---|
| Inventory | Not knowing the modem is there | Every investigation finds a device nobody knew about |
| Off the internet | Opportunistic scanning and default logins from anywhere | HMIs found by internet scans and logged into with defaults |
| Passwords | The default in the manual, the password everyone knows | A remote tool with a shared password and a changed setpoint |
| MFA | A stolen or guessed password being enough | VPN credentials from a phishing email |
| Tested backup | Ransomware ending the plant | SCADA ransomed and rebuilt from nothing over weeks |
| Manual operation | A compromised SCADA becoming a compromised process | Plants that kept treating water while the SCADA was down |
| Segmentation | Office malware reaching the controllers | Ransomware that spread from an office PC to the HMI |
| Vendor access control | A vendor compromise becoming the utility compromise | Integrator remote access used by an attacker |
| Named accounts | Not knowing who did it | Investigations that could not tell an insider from an intruder |
| The call list | Losing hours deciding who decides | Slow responses while the process ran unattended |
After the ten
A utility that has done the ten has a program, whether or not it is called one. The next steps are the ones the larger frameworks describe: a risk assessment that ranks what is left, a zone and conduit drawing, a jump host in a DMZ, firewall rule review, patching on a schedule, change detection on the controllers, and the incident response plan that the one-page call list grows into. The America's Water Infrastructure Act risk and resilience assessment, where it applies, and the free assessments and tools from the federal agencies that support the water sector are the natural framework for that next stage, and a utility arriving at them with the ten done will find most of the findings already closed.
Who does it
Every measure on the list needs a person, and at a small utility that person is usually the operator in charge or the superintendent, with an integrator or a contractor for the network work. The measures are assigned with a date, reviewed at a monthly meeting that takes fifteen minutes, and repeated on their schedule: the inventory annually, the backup restore annually, the manual operation exercise annually, the password review when someone leaves. A binder in the control room with the inventory, the backup log, the call list, and the dates is the whole program document, and it is enough.
Frequently asked questions
- We have never had a problem. Why now?
- Because the scans that find reachable control systems run continuously and the incidents at utilities like yours are public. The measures cost days and prevent the outcomes that have already happened elsewhere. Not having had a problem is the situation every utility in the incident reports was in the day before.
- We cannot afford a firewall or a security consultant.
- The first five measures need neither. A small industrial firewall costs less than a pump repair, and the state, the sector associations, and the federal agencies offer free assessments, training, and in some cases funding. The expensive part of cybersecurity is the incident.
- Our integrator handles all of this.
- Ask them to show you: the inventory, the backup restore date, how they connect and how it is turned off, and who has the passwords. A good integrator will have answers and will welcome the utility owning the list. An integrator who is the only one who knows is a single point of failure the utility should not accept.
- What about our office network and email?
- They matter, and phishing is the usual way in, but this page is about the control system. The office side gets the same basics from its own provider: patches, MFA, backups, and training. The segmentation measure is what keeps an office problem from becoming a plant problem.
Related topics
- Water and Wastewater Utility Threat LandscapeWhat has actually happened at water utilities, what those incidents had in common, and the small number of controls that would have prevented most of them.
- Default CredentialsThe passwords printed in the manual: where they hide in a control system, why they are the first thing an attacker tries, how to find every one on site, and the procedure for changing them without locking yourself out.
- PLC Program BackupsWhat a complete controller backup contains, how often to take one, where to keep it, why the upload from the running controller is not the master, and the verification that turns a folder of files into a recovery plan.
- Vendor Remote AccessIntegrators and equipment vendors need to get in. How to let them without leaving a permanent door open: utility-controlled sessions, named accounts, MFA, a jump host, session recording, and what to do about the modem you did not know was there.
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- IEC 62443The international standard series for industrial automation and control system security: how it is organized, what security levels and foundational requirements mean, and how a utility or integrator actually uses it.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.