The conventional wisdom says your operational technology should never touch the internet. After Iranian-linked actors compromised water utilities in at least 12 states by exploiting internet-connected programmable logic controllers (PLCs), CISA advised: "remove publicly exposed PLCs and other operational technology from the internet as soon as possible."
It's the right tactical response to an active campaign, but it's also incomplete advice that ignores why these devices were internet-connected in the first place.
The Incomplete Picture
Complete air-gapping of operational technology sounds appealing in a security framework. In practice, it creates a different set of risks that water utilities, particularly smaller ones, can't absorb.
Here's what the "just disconnect everything" crowd misses: water utilities operate on tight budgets with minimal IT staff. When a pump station 40 miles from the main facility needs monitoring, internet connectivity isn't a luxury. It's often the only viable option for detecting equipment failures before they cause service disruptions.
The attacks CISA documented show actors changing passwords and removing monitoring capabilities after gaining remote access. But consider what happens when you eliminate remote access entirely. You're trading one failure mode (potential compromise) for another (delayed detection of mechanical failures, inability to respond to pressure changes, mandatory truck rolls for routine checks).
The FBI noted that operational effects included "loss of pressure and flooding." Remove remote monitoring, and you won't detect pressure anomalies until customers call to report brown water or a main breaks visibly. That's not security; it's security theater that degrades operational resilience.
The Real Problem
CISA's advisory reveals the real problem isn't connectivity, it's authentication and segmentation. The threat actors exploited PLCs with default credentials, weak passwords, or no authentication requirements. They didn't exploit zero-day vulnerabilities in industrial protocols or conduct sophisticated supply chain compromises.
The FBI's guidance buried the actual controls that matter: firewalls, unique passwords, and restricting communication to expected control devices. These are basic implementations of the Principle of Least Privilege and network segmentation that appear in every operational technology security standard, from ANSI/ISA-62443 to NIST SP 800-82.
Jake Braun's observation about the strategic implications is telling. He noted that the attacks undermine trust in government services and could disrupt military installations and data centers. But the mechanism of disruption wasn't sophisticated. These actors succeeded because fundamental access controls were missing, not because air-gapping is the only defense against nation-state threats.
Practical Steps for Risk Reduction
Your operational technology needs defense in depth, not isolation. Here's what actually reduces risk:
Implement network segmentation with enforceable boundaries. Put PLCs behind industrial firewalls that understand protocols like Modbus and DNP3. Configure these firewalls to allow only specific IP addresses and only the commands necessary for legitimate operations. This is connectivity with boundaries.
Require multi-factor authentication for any remote access. If your SCADA system allows password-only access from the internet, you're already compromised. Use VPN concentrators that enforce certificate-based authentication plus time-based tokens. Make remote access sessions logged and time-limited.
Deploy intrusion detection systems that understand OT protocols. Generic network monitoring won't catch an unauthorized Modbus write command. You need sensors that know what normal PLC communication looks like and can flag deviations, like password changes or unexpected device reconfigurations.
Establish out-of-band monitoring for critical parameters. If your only visibility into pump pressure comes through the same network path an attacker can compromise, you're blind when it matters most. Use separate cellular or satellite links for read-only telemetry on critical measurements.
Create operational playbooks for degraded connectivity. Your team needs documented procedures for manual operations that don't assume "just drive to the site." What's your maximum acceptable response time? Where are the manual override points? Who's authorized to operate them? These questions matter whether you're responding to a cyberattack or a backhoe cutting your fiber line.
The Clayton County Water Authority had to issue a boil water advisory after their incident. That's a public health response to a control system failure. Your incident response plan needs to integrate with your water quality monitoring protocols, not treat them as separate domains.
When Air-Gapping Makes Sense
Air-gapping absolutely makes sense for specific scenarios. If you're operating a critical control system that genuinely doesn't need remote access, a treatment plant where operators are on-site 24/7, for instance, then internet connectivity adds risk without operational benefit.
Safety instrumented systems that implement emergency shutdowns shouldn't depend on network availability. These systems need to fail safe regardless of IT infrastructure status, which argues strongly for physical isolation.
Legacy systems running unsupported operating systems that can't be patched or hardened should be isolated until they can be replaced. If your PLC is running an embedded OS from 2003 with known vulnerabilities and no available updates, the attack surface is too large to expose.
And during active compromise, like the campaign CISA is tracking right now, temporary disconnection buys you time to implement proper controls. That's incident response, not architecture.
But turning "disconnect during incidents" into "disconnect permanently" ignores the operational reality of critical infrastructure. Water doesn't stop flowing because your security model is elegant. The goal isn't eliminating connectivity; it's ensuring that connectivity doesn't create single points of failure that bypass your detective and preventive controls.
The Iranian actors targeting water utilities succeeded because utilities treated internet connectivity as binary: either wide open or completely closed. The mature approach recognizes that operational technology needs controlled, monitored, authenticated connectivity, not isolation that creates new operational risks while claiming to reduce security ones.
