Water utility cyber resilience gaps are forcing new segmentation models

At a glance

What this is: Elisity argues that water utilities are being pushed toward new segmentation models because flat networks, weak passwords, and exposed OT systems make lateral movement too easy.

Why it matters: For IAM, PAM, and NHI practitioners, the lesson is that identity-aware control has to extend into operational networks where shared access, service accounts, and unmanaged devices can turn a small foothold into broad reach.

Context

Water utility cybersecurity is no longer just a perimeter problem. When IT environments, OT systems, and business applications share too much trust, an attacker who gets one foothold can move into operational systems that were never designed for modern identity controls or segmented access.

In this article, the article's primary concern is governance and control failure rather than a single exploit: weak authentication, poor visibility, and flat networks create the conditions for lateral movement. That matters to identity and access teams because OT environments often expose the same trust gaps seen in NHI estates, only with higher operational consequence.

Key questions

Q: How should organisations segment IT and OT networks to reduce lateral movement without disrupting operations?

A: Organisations should isolate OT from IT with segmentation that limits lateral movement, then add tightly controlled pathways for monitoring, maintenance, and approved business traffic. The goal is not perfect isolation at any cost. It is reducing exposure while preserving safety and uptime. OT environments need controls that account for legacy systems, continuous operations, and the risk that even routine changes can interrupt physical processes.

Q: Why do default passwords create such high risk in water infrastructure?

A: Default passwords turn exposed devices into easy entry points, especially where legacy OT systems lack MFA or modern session controls. Once an attacker authenticates, they can use that access to reach adjacent systems if the network is flat or poorly governed. In critical infrastructure, password hygiene is a frontline control, not an administrative detail.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: How should water utilities prioritise response planning versus containment controls?

A: Utilities should treat containment controls as the prerequisite for effective response, not a replacement for it. Incident plans help teams recover, but if lateral movement is unconstrained, response teams will face a much larger and less predictable problem. The right sequence is to reduce internal reach first, then rehearse recovery around the smaller blast radius that remains.

Technical breakdown

Why flat OT and IT networks enable lateral movement

Flat networks collapse trust boundaries. In water utilities, IT devices, business applications, SCADA components, PLCs, RTUs, and remote access paths often coexist with too little isolation, so one compromised account or exposed host can reach systems far beyond its original role. The problem is not only perimeter exposure, but also the absence of internal enforcement that constrains east-west traffic. When identity is weak and segmentation is coarse, defenders lose the ability to distinguish legitimate operational flows from attacker movement.

Practical implication: map internal trust paths and segment OT from IT so compromise in one zone cannot freely propagate.

How weak authentication becomes a control-system entry point

The article shows a recurring pattern in critical infrastructure: default passwords and legacy authentication open the door, then attackers exploit connectivity to expand their reach. OT platforms frequently lack modern MFA, device identity, or session-level controls, and many cannot run security agents. That leaves access governance dependent on network design, password hygiene, and operational discipline. In practice, authentication weakness is amplified by legacy systems that were built for availability first and identity assurance second.

Practical implication: remove default credentials, tighten remote access paths, and treat inherited OT authentication as a high-risk control gap.

Why asset inventory is the prerequisite for segmentation

Segmentation cannot be enforced reliably if operators do not know what is on the network or how it communicates. The article highlights missing inventories, unmanaged devices, and hidden communication paths as core problems in water utilities. Inventory is therefore not just a documentation exercise, but the control surface for policy design. Without it, policy teams cannot create accurate allowlists, identify unmanaged endpoints, or distinguish approved OT relationships from shadow connectivity.

Practical implication: build an accurate asset and communication inventory before attempting fine-grained segmentation or zero trust enforcement.

Threat narrative

Attacker objective: The objective is to move from an initial foothold into operational systems where disruption, surveillance, or service interference can affect water delivery and public confidence.

1. Entry occurs through default passwords, exposed systems, or other weak authentication paths into IT or OT-connected assets.
2. Credentialed access is then used to move laterally across flat internal networks and reach operational technology with limited resistance.
3. Impact follows when attackers disrupt billing systems, manipulate control environments, or establish long-term access inside critical infrastructure.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Flat-network lateral movement is the core governance failure in water utility cyber risk. The article is not really about one tool or one alert condition. It shows that once IT and OT trust each other too broadly, attackers can move from ordinary footholds into control environments that were never meant to be reachable in that way. For practitioners, segmentation is a governance control, not just a network design choice.

Default-password exposure in OT environments is an identity problem first and a resilience problem second. The recurring pattern is not sophisticated exploitation, but weak assurance around who or what is allowed to access control systems. That makes identity hygiene, remote access governance, and credential lifecycle discipline central to critical infrastructure defence. Practitioners should treat inherited OT credentials as standing risk, not background noise.

Asset blindness creates segmentation debt. If a utility cannot enumerate devices, trust paths, and communications, it cannot safely build enforcement boundaries or prove least privilege. This is especially relevant where human administrators, vendor access, and embedded machine identities coexist in the same operational fabric. Practitioners should see inventory and classification as prerequisites for zero trust, not reporting overhead.

Water-sector resilience now depends on identity-aware containment, not just incident response plans. The EPA resources matter because they reinforce the operational reality that recovery begins before an incident. If compromise can traverse the environment faster than teams can classify it, the control objective shifts to limiting blast radius in advance. Practitioners should align segmentation, access governance, and recovery planning as one programme.

Microsegmentation is becoming the practical expression of least privilege for critical infrastructure. In water environments, least privilege cannot stay at the account layer if lateral movement still crosses the network unchecked. The article shows why identity and network controls must converge around device groups, operational zones, and approved flows. Practitioners should evaluate whether their current model actually constrains east-west movement or merely observes it.

What this signals

Identity-aware segmentation is becoming the right control model for critical infrastructure. Water utilities cannot rely on perimeter security or passive monitoring when attackers can cross from IT into OT through ordinary trust relationships. The operational question is whether the environment enforces least privilege on communication paths, not just on user accounts.

Asset inventory is now a control prerequisite, not a housekeeping task. Utilities that cannot enumerate their devices and communication flows cannot design accurate containment boundaries. That means discovery, classification, and policy enforcement need to be treated as one programme rather than separate projects.

For NHI and access governance teams, the lesson is that machine and human identities behave differently inside flat infrastructure. Shared credentials, unmanaged devices, and vendor access create the kind of standing trust that attackers exploit once they enter the network. Practitioners should extend identity governance into operational zones where privilege still moves faster than review cycles.

For practitioners

• Map IT-to-OT trust paths Document every path by which an IT foothold can reach SCADA, PLC, RTU, HMI, and vendor-managed systems, then remove or isolate paths that are not operationally required.
• Eliminate default and shared credentials Reset factory passwords, remove shared logins where possible, and enforce unique account ownership for operators, administrators, and third-party support access.
• Build a living asset inventory Continuously identify devices, identities, and communication flows so segmentation policies can be based on actual dependencies rather than assumed architecture.
• Create enforceable zone boundaries Group business systems, plant networks, IoT devices, and unmanaged endpoints into distinct policy zones so lateral movement is blocked by design.
• Exercise manual-operability procedures Test how to maintain billing, monitoring, and plant operations when automated systems are disrupted, using incident checklists and tabletop scenarios.

Key takeaways

• Water utility risk is driven less by exotic exploits than by over-trusted internal connectivity, weak authentication, and limited OT visibility.
• The article shows how quickly a foothold can become operational disruption when billing, monitoring, and control systems share the same trust fabric.
• Utilities need containment and recovery plans, but those plans only hold if segmentation, inventory, and access governance reduce the attacker’s room to move.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Standing Trust: Persistent confidence in an identity, broker, or automation path to request privilege without sufficient ongoing verification. For NHIs, standing trust can remain even when credentials are short lived, which means the organisation has reduced exposure time but not necessarily reduced the chance of abuse.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is built for practitioners who need to govern access, privilege, and lifecycle risk across human and non-human identities.