Topic starter
25/10/2026 11:08 am
TL;DR: Internet-exposed PLCs in water and wastewater can lock out operators and force manual work, according to Censys. Unmanaged remote access, including cellular modems, leaves controllers outside normal inventory and response.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “CISA Alert: Water Sector PLC Targeting”.
By the numbers:
- Censys identified 4,148 internet-exposed hosts that respond to EtherNet/IP and self-identify as Rockwell Automation/Allen-Bradley.
- Censys identified 4,117 internet-exposed hosts that fingerprint as Siemens SIMATIC S7-1200.
- Censys identified 2,072 internet-exposed hosts fingerprinting as Schneider Electric hardware.
Key questions
Q: Why do undocumented cellular modems create so much OT risk?
A: They create hidden remote access paths that often sit outside normal discovery, change control, and review processes.
Q: What signs suggest PLC access governance is failing?
A: Common signals include externally reachable controllers, unexpected modem presence, default credentials, and remote paths that no one can name with confidence.
Q: What breaks when PLCs are exposed directly to the Internet?
A: Direct exposure removes the safety margin that OT segmentation is supposed to provide.
Practitioner guidance
- Remove direct internet reachability for PLCs Route remote administration through a controlled VPN or gateway, and block direct public access to controller management interfaces.
- Inventory every cellular modem and vendor link Capture operator-installed, vendor-installed, and integrator-installed modem paths in the same asset and access inventory as the PLCs they serve.
- Enforce unique credentials and password recovery procedures Replace default passwords, restrict who can modify controller credentials, and document recovery steps for controller lockout scenarios.
Bottom line: Internet-facing PLCs in the water sector create a privilege and recovery problem, not only an exposure problem.
Glossary terms: Programmable Logic Controller, Operational Technology, Remote Access Gateway, Modem-Mediated Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Internet-facing PLCs create a privileged access problem, not just an exposure problem. Once a controller is reachable from the public internet, the issue becomes who can administer it, what changes are allowed, and how that access is revoked. In OT, the management plane often sits outside normal identity governance, so the attacker only needs one weak path to reach a high-impact function. The practitioner conclusion is to treat remote PLC administration as privileged access that must be mediated, logged, and tightly bounded.
A question worth separating out:
Q: How should operators respond when PLC access is already compromised?
A: Containment should focus on severing unauthorised remote reachability, preserving the controller state, and restoring only through validated access paths. Operators should avoid assuming the device can be reached or repaired normally until the remote path is confirmed clean. Recovery must be coordinated with safety and operations so the plant does not worsen the disruption while trying to fix it.
👉 Read our full editorial: Exposed PLCs in water systems create direct operator lockout risk
This post was modified 7 days ago by NHI Mgmt Group