CISA's August alert was clear: remove publicly exposed programmable logic controllers (PLCs) and operational technology (OT) from the internet immediately. This was prompted by a coordinated attack on over 30 Minnesota community water systems starting July 26. The attack forced boil water notices and manual operations after attackers modified passwords and changed PLC IP addresses, locking out operators.
If you're managing risk for a water utility, take this seriously. The threat actor is targeting facilities of all sizes, and investigators are examining possible connections to Iran-linked activity. Your PLCs control pumps, valves, and treatment processes. Internet exposure turns them into remote control panels for adversaries.
This guide walks you through removing that exposure and securing external OT connections in under a week.
What You Need Before Starting
Asset inventory: Compile a complete list of every PLC, SCADA server, HMI, and RTU in your environment. Include make, model, IP address, and current network segment. If you don't have this, start with a passive network scan using tools like Nozomi Networks or Claroty to discover OT assets without disrupting operations.
Network documentation: Map every external connection, including cellular modems installed by vendors or system integrators. CISA warns that even water organizations with mature cybersecurity processes should validate these connections because they're often undocumented and excluded from routine attack surface scans.
Change control approval: You're about to modify production systems. Get written approval from operations leadership and schedule a maintenance window. Document current configurations before you touch anything.
Backup connectivity plan: If you're removing internet access from PLCs that vendors use for remote support, establish an alternative: VPN with multi-factor authentication, jump hosts behind firewalls, or scheduled dial-in windows.
Stakeholder communication: Notify your operations team, vendors who provide remote support, and your incident response contacts. Set expectations about downtime and new access procedures.
Step-by-Step Implementation
Phase 1: Identify Internet-Exposed Assets (Day 1)
Run external scans from outside your network to find what attackers see. Use Shodan or Censys to search for your organization's IP ranges and look for exposed SCADA protocols (Modbus TCP port 502, DNP3 port 20000, BACnet port 47808).
Cross-reference these findings with your asset inventory. Any PLC or OT device appearing in external scans needs immediate remediation.
Check firewall rules for any overly broad access control lists allowing inbound traffic to OT network segments. Document every rule that allows external access to operational technology.
Phase 2: Establish Segmentation (Days 2-3)
Before removing internet access, ensure you're not cutting off legitimate operational needs. Deploy network segmentation following ANSI/ISA-62443 zone and conduit models:
Create a DMZ between your IT network and OT environment. Place jump hosts or VPN concentrators in this DMZ. Configure firewall rules that:
- Block all inbound traffic from the internet to OT networks.
- Require VPN authentication for any external access.
- Log every connection attempt to OT assets.
For cellular modems discovered during your inventory, replace direct PLC connections with connections to a VPN gateway. If a modem must remain for backup communications, configure it to only accept connections from specific source IPs and disable all unnecessary services.
Phase 3: Remove Direct Internet Exposure (Day 4)
Working system by system during your maintenance window:
For PLCs with public IPs: Change the IP address to a private RFC 1918 address (10.x.x.x, 172.16-31.x.x, or 192.168.x.x). Update your firewall to block any inbound traffic to the old public IP. Verify the PLC still communicates with your SCADA system on the internal network.
For vendor remote access: Disable any built-in remote access features (e.g., Rockwell FactoryTalk Remote Access, Siemens TeleService). Configure VPN access instead, requiring multi-factor authentication and time-limited sessions. Create vendor-specific accounts with Role-Based Access Control, not shared credentials.
For SCADA servers: Move them behind firewalls with no direct internet access. If operators need remote access, deploy a bastion host in your DMZ that requires VPN and logs all sessions.
Document every change in your configuration management system with before and after network diagrams.
Phase 4: Harden Authentication (Day 5)
The Minnesota attackers modified passwords to lock out operators. Address this immediately:
Change default credentials on every PLC, HMI, and OT device. Use unique passwords for each device, stored in a Privileged Access Management system like CyberArk or Thycotic.
Enable account lockout policies where supported. Many PLCs don't offer this natively, so implement it at the network level: configure your firewall to block source IPs after multiple failed authentication attempts.
Disable unused accounts, especially vendor service accounts left active after projects end. Apply the principle of least privilege to OT as much as IT.
Validation: How to Verify It Works
Run the same external scans you performed in Phase 1. Your OT assets should no longer appear in Shodan or respond to external probes on operational protocols.
Test vendor access by having a remote technician connect through your new VPN process. Verify they can reach only the specific systems they need, not your entire OT network.
Review firewall logs for any blocked connection attempts to OT assets from external IPs. You should see attempts being denied at the perimeter.
Conduct a tabletop exercise where your team responds to a simulated lockout scenario. Can you regain control of a PLC if an attacker changes credentials? Your recovery process should include physical access to devices and console connections that bypass network authentication.
Maintenance and Ongoing Tasks
Weekly: Review firewall logs for anomalous connection attempts to OT networks. Look for patterns indicating reconnaissance or brute force attacks.
Monthly: Audit active accounts on PLCs and SCADA systems. Remove any that shouldn't exist. Rotate vendor access credentials after each maintenance visit.
Quarterly: Rescan your external attack surface to catch any new exposures from system additions or configuration drift. Update your asset inventory with any new OT devices.
Annually: Conduct penetration testing that specifically targets OT segmentation. Verify an attacker compromising your IT network can't pivot to operational systems.
Subscribe to alerts from WaterISAC and CISA's ICS-CERT. When new vulnerabilities affect your PLC models, you need to know within hours, not weeks.
The FBI reports that utility companies in at least seven states have reported PLC incidents. Your facility might be next if you're running internet-exposed operational technology. The attackers are targeting water entities of all sizes, which means your 5,000-person service area doesn't make you too small to hit.
Remove the exposure this week. The manual operations and boil water notices in Minnesota show what happens when you don't.
