Water utilities need brokered access before legacy OT modernization

At a glance

What this is: This is an analysis of why water-sector OT keeps failing at the access layer, with the key finding that legacy assets become risky when connectivity is allowed to act as trust.

Why it matters: It matters because IAM, PAM and NHI governance have to protect operational control paths before legacy modernization finishes, not after.

Context

Water utilities often run on legacy operational technology that was built for deterministic control, not modern trust decisions. In that environment, the security problem is not only device weakness but the architecture around it: a connection can become control authority if identity, authorization and session boundaries are not enforced before the asset is reached.

The article’s core claim is that waiting for wholesale modernization leaves too much exposure in place for too long. For IAM and PAM teams, this is a direct identity governance problem because humans, vendors and machine connections can all be allowed to exercise privileges that outlast the task they were meant to support.

Key questions

Q: What breaks when legacy PLCs and HMIs cannot enforce identity controls?

A: When legacy OT devices cannot verify users or applications, the control point moves outside the device. Security then depends on the access path, not the controller, so weak authentication, shared logins and broad remote reach can all turn into physical process risk. The answer is to govern access before the asset is reachable.

Q: Why do standing OT access paths increase operational risk?

A: Standing access turns remote maintenance and supplier convenience into persistent trust. If the same credentials, conduits, or VPN paths remain available all the time, attackers only need to compromise one of them to reach critical systems. Time-bound and segment-bound access reduces the window in which that trust can be abused.

Q: What are the signs that OT access governance is not keeping up?

A: Look for overlapping VPN access paths, shared accounts across vendors and internal staff, incomplete session logs, and maintenance workflows that cannot show when access started or ended. Those are practical indicators that the organisation can connect systems, but cannot yet prove controlled access or defensible traceability.

Q: How should utilities balance modernization with access control today?

A: Utilities should modernize on a long horizon, but they should not wait for replacement before reducing trust. The practical balance is to externalise MFA, segment access to specific assets, record privileged sessions and remove direct exposure now, while capital plans handle device renewal later.

Technical breakdown

Why legacy PLCs cannot enforce modern identity controls

Legacy PLCs, HMIs and field devices were designed to run physical processes, not to verify users. Many cannot support MFA, individual identities, granular authorization, useful logs or endpoint agents, and industrial protocols such as Modbus were not built for untrusted networks. That means the security decision has to be made outside the device, before traffic reaches it. In practice, the lack of native identity support turns the controller into a trust sink: once connected, it may accept commands from a legitimate operator, a compromised workstation or a vendor tool with equal ease.

Practical implication: Externalise authentication and authorization in front of legacy assets instead of assuming the controller can enforce policy itself.

Why reachability becomes control authority in OT environments

OT environments often need remote access across cellular, radio, leased and municipal networks, but remote access does not have to mean broad trust. The architectural flaw appears when network reachability is treated as proof of legitimacy, allowing a user or application to discover and interact with more equipment than the task requires. In that model, the initial connection is effectively a privilege grant. That is why excessive reach, direct exposure and unsegmented remote tooling repeatedly turn small access mistakes into operational incidents.

Practical implication: Broker every remote session to a specific asset, protocol and approved window rather than exposing the OT network as a whole.

How just-in-time access and session oversight change the risk model

Just-in-time access changes the control point from persistent entitlement to time-bounded authorization. Session oversight matters because OT risk is not only who connected, but what tool was used, what file moved and whether a logic or configuration change altered the process. For legacy equipment, that oversight has to sit around the device, recording and governing privileged interactions without depending on the asset to do the work. This is especially important where vendor access, engineering workstations and reusable identities create a long-lived path into the plant.

Practical implication: Use time-bound access, recorded sessions and asset-specific policy to reduce standing privilege and make engineering activity auditable.

Threat narrative

Attacker objective: The attacker’s objective is to turn a trusted connection into direct influence over physical operations while avoiding the need to defeat the legacy device itself.

1. Entry begins when attackers, insiders or vendors use exposed remote access, reusable credentials or overly broad network connectivity to reach OT systems.
2. Credential or session abuse follows when the connection is trusted too widely, allowing access to controllers, engineering tools or SCADA-related environments beyond the intended task.
3. Escalation occurs when legitimate tools are used to change logic, settings or alarms, turning access into operational control over physical processes.
4. Impact is the manipulation, shutdown or disruption of water and wastewater operations, sometimes with persistent access that can be reused across sites.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy OT security fails when architecture treats connectivity as trust. The article’s strongest point is that the device does not need to be modern if the access path is governed correctly. Water-sector risk persists because authentication, authorization and change control are often applied too late, after the connection has already crossed into the operational zone. The practitioner takeaway is to govern the path first, then modernise the asset on a longer timeline.

This is an identity governance problem, not only an OT problem. Human users, vendors and machine connections all need a defined relationship to a specific asset, task and time window. Where that relationship is missing, standing privilege and reusable access become the default control model. That makes IAM, PAM and NHI controls relevant even when the protected target is a 20-year-old PLC.

Reachability without segmentation creates a repeatable attack path. The article shows that internet-facing controllers, exposed remote tools and broad network access keep re-creating the same failure mode across utilities. The named concept here is trusted reachability debt, meaning accumulated exposure from connections that were granted for convenience and never reduced. Practitioners should treat every exposed path as a governance defect, not an inevitability.

Operational resilience depends on externalised control of change. The article correctly highlights that legitimate engineering tools can be abused as readily as custom malware. That means session recording, file governance, known-good logic validation and asset-specific policy matter as much as perimeter defence. The practitioner conclusion is to make every privileged interaction observable and revocable before the asset is asked to make security decisions it cannot make.

What this signals

Water-sector programmes should assume that legacy OT will remain in service for years, which means the access architecture has to do the heavy lifting now. The most important shift is from network trust to brokered, identity-bound control of each privileged interaction.

Trusted reachability debt: this is the accumulation of exposed services, standing access and implicit network trust that keeps recreating the same attack path. For practitioners, the implication is clear: every exposed controller or vendor path should be treated as a governance defect until it is brokered, segmented or removed.

For practitioners

• Externalise identity and MFA in front of legacy assets Put an enforcement layer between users and PLCs, HMIs or remote field devices so named identity, MFA and policy are checked before access reaches the controller.
• Replace standing remote access with just-in-time approval Grant vendor and engineer access only for a specific asset and task window, then remove it automatically when the work ends.
• Record and review privileged OT sessions Capture what was connected, what tool was used, what file changed and which controller received the change so engineering activity stays auditable.
• Segment by asset, not by broad network trust Limit each workstation, application or vendor path to the exact controllers it is authorised to manage, and prevent discovery of unrelated devices.
• Retire direct internet exposure for controllers and modems Remove exposed PLCs, HMIs, VNC services and remote-management interfaces from public reach, and broker all approved access through controlled paths.

Key takeaways

• Legacy water-sector OT is vulnerable not simply because the assets are old, but because too much authority is still granted through the access path.
• The repeating failure pattern is broad reach plus weak identity governance, which lets a connection become control over pumps, dosing and alarms.
• The most effective near-term response is to externalise MFA, just-in-time access and session oversight in front of assets that cannot secure themselves.

Key terms

• Reachability Debt: Reachability debt is the accumulated risk created when tools gain more network latitude than they need and that latitude is never revisited. It is especially dangerous in security tooling, where capabilities are often added incrementally without a full review of egress and redirect behavior.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Operational Technology Identity: An identity used in environments where digital access can affect physical processes, equipment, or uptime. These identities often carry higher operational risk because access mistakes can move beyond data exposure into safety, availability, and process integrity concerns.
• Brokered Access: Brokered access is a model where the user or workload proves identity to an intermediate control plane that issues short-lived access instead of exposing a reusable secret. For privileged operations, this shifts governance from secret storage to session control, auditability, and timely revocation.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and identity practitioners translate access control principles into measurable governance for real environments.