Topic starter
23/10/2026 12:47 am
TL;DR: Internet-facing PLCs with default credentials let small changes disrupt U.S. water and wastewater operations, according to Corelight. OT availability now depends on catching exposed devices, drift, and protocol changes before a minor edit becomes an outage.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “The water system attacks were simple. Securing OT isn't.”.
Key questions
Q: Why do small configuration changes create such large OT outages?
A: Many OT systems depend on fixed addresses, stable routing, and tightly coupled device-to-system relationships.
Q: How do teams know if OT segmentation is still working?
A: OT segmentation is working only if access decisions remain accurate when systems move, scale, or connect to new platforms.
Q: What breaks when internet-facing PLCs still use default credentials?
A: Attackers can authenticate with minimal effort and then alter device settings, break communications, or interrupt the physical process the PLC supports.
Practitioner guidance
- Inventory all internet-facing OT assets Validate which PLCs, cellular modems, routers, and vendor-maintained devices are actually reachable from outside the OT boundary.
- Eliminate default and shared credentials Replace factory defaults and shared logins on exposed devices with uniquely assigned credentials and tight administrative ownership.
- Verify segmentation with live network data Test whether isolated OT zones are truly isolated by tracing actual communications, including vendor access and remote admin paths.
Bottom line: Internet-facing PLCs with default credentials create a direct path from trivial access to real operational disruption.
Glossary terms: Programmable Logic Controller, Segmentation Drift, Configuration integrity, Request-Level Telemetry
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:48 am
Exposure, not sophistication, is the governing failure here: the attacker only needed internet reachability and weak authentication to cause disruption. In OT, that means the real control gap is not advanced tradecraft but unmanaged access paths and credentials left in place. Practitioners should treat every externally reachable PLC as a governance issue, not just a network topology issue.
A question worth separating out:
Q: Who is accountable for remote access into critical OT devices?
A: Accountability should sit with the team that owns both the operational outcome and the access path, which usually means OT operations, network security, and vendor management together. Remote access must be approved, documented, segmented, and periodically revalidated because it can become standing privilege into devices that support essential services.
👉 Read our full editorial: Water system attacks expose the fragility of internet-facing PLCs
This post was modified 6 days ago by NHI Mgmt Group