Internet-facing PLCs: what OT teams need to verify now

TL;DR: Recent attacks on U.S. water and wastewater systems exploited internet-facing PLCs, default credentials, and simple configuration changes such as IP address edits to disrupt operations, according to Corelight, underscoring how little specialized OT knowledge is needed to trigger real-world impact. The governance problem is asset exposure and segmentation drift, not attacker sophistication.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “The water system attacks were simple. Securing OT isn't.”.

Key questions

Q: What breaks when internet-facing PLCs still use default credentials?

A: Attackers can authenticate with minimal effort and then alter device settings, break communications, or interrupt the physical process the PLC supports.

Q: Why do small configuration changes create such large OT outages?

A: Many OT systems depend on fixed addresses, stable routing, and tightly coupled device-to-system relationships.

Q: How do teams know if OT segmentation is still working?

A: OT segmentation is working only if access decisions remain accurate when systems move, scale, or connect to new platforms.

Practitioner guidance

• Inventory all internet-facing OT assets Validate which PLCs, cellular modems, routers, and vendor-maintained devices are actually reachable from outside the OT boundary.
• Eliminate default and shared credentials Replace factory defaults and shared logins on exposed devices with uniquely assigned credentials and tight administrative ownership.
• Verify segmentation with live network data Test whether isolated OT zones are truly isolated by tracing actual communications, including vendor access and remote admin paths.

Bottom line: Internet-facing PLCs with default credentials create a direct path from trivial access to real operational disruption.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →