Over 100 water systems targeted in a single month. Attackers exploiting programmable logic controllers connected via cellular modems. Default credentials and outdated software providing easy entry points. If you're responsible for operational technology security in the water sector, you're facing a systemic risk that requires immediate, methodical action.
This checklist translates CISA's recent guidance into concrete steps you can implement now. It's designed for practitioners managing OT environments that were never built for internet exposure but now find themselves in the crosshairs of persistent threat actors.
Prerequisites
Before you start, you need:
- Asset inventory access: Complete list of PLCs, SCADA systems, and control devices across your environment
- Network documentation: Current network diagrams showing segmentation, remote access paths, and vendor connections
- Stakeholder alignment: Operations teams must be part of this process, not informed after the fact
- Change control authority: You'll need to modify remote access configurations and potentially interrupt connectivity
Internet Exposure Assessment and Remediation
1. Map Every Internet-Reachable OT Asset
Search your known IP space and beyond for exposed devices. Include vendor infrastructure, contractor access points, and legacy systems that may sit outside your documented network.
What to do: Run discovery scans using Shodan, Censys, or Thingful against your organization's IP ranges. Search for common OT protocols (Modbus, DNP3, BACnet) and device types (PLCs, RTUs, HMIs).
Good looks like: You have a complete inventory of internet-facing OT assets, including those you didn't know existed. Each asset is tagged with its business owner, operational necessity, and exposure justification. You've identified cellular modems connecting controllers directly to the internet without intermediate security controls.
2. Evaluate Operational Necessity for Each Exposed Asset
For every internet-reachable system, answer: Does this exposure serve a legitimate operational purpose, or is it a legacy configuration no one questioned?
What to do: Work with operations teams to document why each exposed asset needs internet connectivity. Challenge assumptions. "We've always done it this way" is not a valid justification.
Good looks like: You have a written justification for each internet-exposed asset, signed by the operational owner. At least 30% of initially exposed systems have been identified as unnecessary and scheduled for remediation. You've documented which systems must remain exposed due to vendor support requirements, remote monitoring needs, or operational constraints.
3. Remove Unnecessary Remote Access
Disconnect systems that don't require internet exposure. This is your highest-impact, lowest-complexity win.
What to do: Disable cellular modems on controllers that can be managed through site visits or on-premises access. Remove public IP addresses from devices that only need local network connectivity. Terminate vendor VPN tunnels that haven't been used in six months.
Good looks like: You've reduced your internet-exposed OT footprint by at least 40%. Systems now connect through jump hosts or secure access gateways rather than directly to the internet. You've documented the business case and operational impact assessment for each removal.
4. Secure Necessary Remote Access
For systems that must remain reachable, implement defense-in-depth controls that address the specific vulnerabilities attackers are exploiting.
What to do: Deploy VPN concentrators with multifactor authentication for vendor access. Implement Just-in-Time Access for maintenance windows rather than persistent connections. Replace direct cellular modem connections with secured gateway devices that enforce authentication and logging.
Good looks like: Zero systems use default credentials. All remote access requires MFA. VPN sessions are logged with full session recording. Access is granted on a need-to-use basis with automatic timeout after 4 hours. You've implemented network segmentation per ANSI/ISA-62443 guidance, isolating OT networks from IT and external connections.
5. Replace End-of-Life Systems
Software and devices no longer receiving security updates are indefensible targets. You cannot patch what the vendor has abandoned.
What to do: Identify controllers, SCADA software, and operating systems running versions that are no longer supported. Build a replacement roadmap with budget justification. For systems that cannot be replaced immediately, implement compensating controls including network isolation and enhanced monitoring.
Good looks like: You have a funded replacement plan for all end-of-life OT systems, with critical devices scheduled for upgrade within 90 days. Systems awaiting replacement are isolated on dedicated VLANs with strict firewall rules and continuous monitoring. You've documented the residual risk and obtained written acceptance from executive leadership.
6. Implement Continuous Monitoring for OT Anomalies
Prevention will fail. You need visibility into what's happening on your OT network to detect compromises before they escalate.
What to do: Deploy OT-aware monitoring tools that understand industrial protocols and can detect configuration changes, unauthorized access attempts, and abnormal device behavior. Configure alerts for password changes, IP address modifications, and unexpected network traffic patterns.
Good looks like: You receive alerts within 5 minutes when a PLC password is changed, an IP address is modified, or a device attempts to communicate with an unexpected external IP. Your monitoring covers both IT-OT boundary traffic and east-west communication within the OT zone. You've established baseline behavior profiles for critical systems and configured anomaly detection thresholds.
7. Establish Microsegmentation and Zero Trust Controls
Reduce the blast radius when a compromise occurs. Assume breach and limit lateral movement.
What to do: Segment your OT network into functional zones based on system criticality and operational requirements. Implement application-level controls that allow only necessary communication between zones. Deploy identity-based access controls that verify every connection attempt, not just initial authentication.
Good looks like: A compromised HMI cannot communicate with PLCs outside its operational zone. Vendor access is limited to specific devices during approved maintenance windows. You've implemented the Purdue Model for ICS network segmentation, with enforced boundaries between Levels 0-5. Each zone has documented communication requirements and firewall rules that default-deny all traffic.
8. Schedule Quarterly Reassessments
Your attack surface changes. New devices get connected. Vendors request access. Configurations drift.
What to do: Repeat steps 1-3 every quarter. Run external discovery scans. Review remote access justifications. Audit VPN logs for unused accounts. Update your asset inventory and exposure documentation.
Good looks like: You have a recurring calendar event with assigned ownership. Each quarterly review produces a written report documenting new exposures, remediated risks, and updated risk acceptance decisions. You've established metrics tracking your internet-exposed OT footprint over time and report trends to executive leadership.
Common Mistakes
Treating OT security like IT security: Industrial control systems require different approaches. Don't apply IT patching cadences or restart procedures without understanding operational impact.
Ignoring vendor and contractor access: Your third parties create exposure you don't control. Many of the targeted systems were accessible through vendor support connections with weak authentication.
Assuming small utilities can't be targets: Small and under-resourced systems account for 81% of U.S. public water systems and 93% of violations for noncompliance with federal drinking water standards. Attackers don't discriminate based on your budget.
Waiting for federal mandates: New York has already imposed cyber requirements on water systems. Other states will follow. Don't wait for regulatory pressure to drive action you know is necessary.
Next Steps
Start with step 1 tomorrow. You don't need a multi-year program or executive approval to begin mapping your internet-exposed assets. The discovery work is non-invasive and will give you the data you need to build a compelling case for remediation resources.
If you're managing a small utility without in-house security expertise, reach out to state resources and volunteer programs like Def Con Franklin that place technical volunteers with under-resourced organizations. CISA's guidance includes specific contact information for sector-specific support.
The attackers are using discovery platforms to find your exposed systems right now. The question isn't whether you'll be targeted, but whether they'll find anything worth exploiting when they look.
