Common warning signs include default passwords still in use, little or no regular cybersecurity assessment, no CISO or equivalent owner, and minimal budget for IT or OT security. If a utility lacks awareness training, monitored protection efforts, or basic access governance, it is likely relying on weak controls that attackers can exploit before anyone notices.
What poor access control looks like in a water utility environment
Water utilities usually fail access control in ways that are visible long before a major incident. Common indicators include shared or default credentials, accounts that are never reviewed, and operators or vendors retaining access long after their work should end. When these patterns persist, the control environment is not enforcing who can enter, change, or monitor critical systems.
Another sign is that access decisions are based on convenience rather than role, location, device trust, or operational need. If SCADA, engineering workstations, historian platforms, remote support paths, and administrative consoles all follow the same broad permissions model, the utility has little practical separation between routine access and high-impact control.
Utilities with weak controls also tend to lack basic visibility. If no one can quickly answer who has privileged access, which vendor sessions are active, or when credentials were last rotated, the access model is effectively ungoverned. That is especially dangerous in operational technology environments, where delayed detection can let misuse persist across shifts and maintenance windows.
Useful background on the underlying identity and access patterns is covered in Ultimate Guide to NHIs and its section on Key Challenges and Risks, both of which map closely to overprivilege, visibility gaps, and unmanaged credentials.
Operational signals that controls are failing, not just imperfect
Some weaknesses are administrative, but the more serious signs are operational. If access reviews happen only on paper, if exceptions become permanent, or if remote access is opened broadly during incident response and never tightened again, the utility is probably treating access as a one-time setup rather than a lifecycle control.
Watch for mismatch between the access granted and the task performed. For example, a support account that can administer unrelated systems, a contractor account that still functions months after the contract ends, or an account that can authenticate without meaningful logging all indicate that the control is not constraining authority in a measurable way. The practical issue is not just excess permission, but the absence of evidence that permission is being actively governed.
In a utility, a weak access model often shows up through legacy exceptions: old remote desktop paths, local admin reuse, shared break-glass accounts with no review, or passwords that have not been changed because operations fear disruption. Those are not isolated oversights. They are signs that availability concerns are outranking security controls without a compensating monitoring model.
A broader identity-security view is useful here because weak access control commonly travels with credential sprawl, delayed rotation, and poor offboarding. The same patterns that create human access risk also create machine and service-account risk, which is why the control gap often remains hidden until a compromise or outage forces a review.
Practitioner judgment for assessing whether the control is good enough
What to verify: Confirm whether the utility can produce a current privileged-access inventory, a record of credential rotation, and evidence that vendors and former staff have been removed promptly. If those artifacts do not exist, the control is not mature enough to trust.
What to measure: Track how many accounts can reach OT, engineering, or remote support systems, how many are privileged, and how many are shared or unused. In practice, a small number of well-owned accounts is healthier than a large pool of ambiguous access paths.
Common mistake: Treating “nobody has reported a problem” as proof that access controls work. In utilities, the failure mode is often silent persistence, where an attacker or unauthorized user can remain present until a maintenance event, vendor session, or safety process exposes the issue.
Practitioner takeaway: If the utility cannot clearly explain who has access, why they have it, and how it is removed or monitored, the access control model is already failing in the only way that matters, it is not preventing or revealing misuse fast enough.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Weak water-utility access control often exposes credentials and long-lived access paths. |
| NHI-03 — Privilege and Access Governance | The question centers on whether privileged access is actually constrained and reviewed. | |
| NHI-05 — Visibility and Discovery | Missing visibility into who can access systems is a core sign of weak controls. | |
| Recommendation — Inventory and rotate credentials that can reach OT or vendor support systems. Restrict privileged access to named roles and review it on a defined schedule. Maintain a live inventory of accounts, permissions, and active remote sessions. | ||
| CIS Controls v8 | 6 — Access Control Management | Access control management directly addresses account review, least privilege, and removal of stale access. |
| 5 — Account Management | Shared, default, or orphaned accounts are direct indicators that account governance is failing. | |
| 8 — Audit Log Management | Poor monitoring and no traceability are signs that access abuse may go undetected. | |
| Recommendation — Enforce least privilege and remove access that no longer matches operational need. Disable default and shared accounts and verify every account has a current owner. Log privileged access and review authentication and admin activity regularly. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The question is fundamentally about whether access is being constrained and governed effectively. |
| DE.CM — Security Continuous Monitoring | Lack of monitored protection efforts and weak detection are central warning signs here. | |
| Recommendation — Align access paths to identity, role, and need before granting system reach. Continuously monitor privileged access and alert on unusual authentication or session use. | ||
| NIST Zero Trust (SP 800-207) | AC-1 — Policy Enforcement | Utility access should be enforced through explicit policy, not broad standing access. |
| Recommendation — Apply policy-driven enforcement to narrow access to the minimum required session. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Utilities that cannot verify who owns access decisions have weak identity assurance. |
| Recommendation — Bind high-impact access to stronger identity proofing and assurance evidence. | ||
Related resources from NHI Mgmt Group
- What are the signs that SOC 2 access reviews are not working well enough?
- What are the signs that cloud storage access controls are not working well enough?
- What are the signs that lateral movement controls are not working well enough?
- What are the signs that CI/CD security controls are not working well enough?
