Internet-exposed PLCs in water systems: what operators are missing

TL;DR: Internet-exposed PLCs in the water and wastewater sector are being targeted in ways that can lock out operators, change device IPs, and force manual operations, according to Censys, while CISA warns that cellular modems remain a common blind spot. The exposure profile shows the problem is not theoretical: it is a governance failure around remote access, inventory, and segmentation.

Editorial analysis by NHI Mgmt Group, based on content published by Censys: “CISA Alert: Water Sector PLC Targeting”.

By the numbers:

• Censys identified 4,148 internet-exposed hosts that respond to EtherNet/IP and self-identify as Rockwell Automation/Allen-Bradley.
• Censys identified 4,117 internet-exposed hosts that fingerprint as Siemens SIMATIC S7-1200.
• Censys identified 2,072 internet-exposed hosts fingerprinting as Schneider Electric hardware.

Key questions

Q: What breaks when PLCs are exposed directly to the Internet?

A: Direct exposure removes the safety margin that OT segmentation is supposed to provide.

Q: Why do undocumented cellular modems create so much OT risk?

A: They create hidden remote access paths that often sit outside normal discovery, change control, and review processes.

Q: What signs suggest PLC access governance is failing?

A: Common signals include externally reachable controllers, unexpected modem presence, default credentials, and remote paths that no one can name with confidence.

Practitioner guidance

• Remove direct internet reachability for PLCs Route remote administration through a controlled VPN or gateway, and block direct public access to controller management interfaces.
• Inventory every cellular modem and vendor link Capture operator-installed, vendor-installed, and integrator-installed modem paths in the same asset and access inventory as the PLCs they serve.
• Enforce unique credentials and password recovery procedures Replace default passwords, restrict who can modify controller credentials, and document recovery steps for controller lockout scenarios.

Bottom line: Internet-facing PLCs in the water sector create a privilege and recovery problem, not only an exposure problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →