Topic starter
24/10/2026 8:49 pm
TL;DR: Legacy water-sector OT becomes risky when broad reach and weak identity governance let access act as trust, according to Xage Security. Access must be governed before pumps, dosing and alarms are reachable.
Editorial analysis by NHI Mgmt Group, based on content published by Xage Security: “Breaking the Water Cyberattack Cycle”.
Key questions
Q: Why do standing OT access paths increase operational risk?
A: Standing access turns remote maintenance and supplier convenience into persistent trust.
Q: What are the signs that OT access governance is not keeping up?
A: Look for overlapping VPN access paths, shared accounts across vendors and internal staff, incomplete session logs, and maintenance workflows that cannot show when access started or ended.
Q: What breaks when legacy PLCs and HMIs cannot enforce identity controls?
A: When legacy OT devices cannot verify users or applications, the control point moves outside the device.
Practitioner guidance
- Externalise identity and MFA in front of legacy assets Put an enforcement layer between users and PLCs, HMIs or remote field devices so named identity, MFA and policy are checked before access reaches the controller.
- Replace standing remote access with just-in-time approval Grant vendor and engineer access only for a specific asset and task window, then remove it automatically when the work ends.
- Record and review privileged OT sessions Capture what was connected, what tool was used, what file changed and which controller received the change so engineering activity stays auditable.
Bottom line: Legacy water-sector OT is vulnerable not simply because the assets are old, but because too much authority is still granted through the access path.
Glossary terms: Brokered Access, Reachability Debt, Just-in-Time Access Request, Operational Technology Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Legacy OT security fails when architecture treats connectivity as trust. The article’s strongest point is that the device does not need to be modern if the access path is governed correctly. Water-sector risk persists because authentication, authorization and change control are often applied too late, after the connection has already crossed into the operational zone. The practitioner takeaway is to govern the path first, then modernise the asset on a longer timeline.
A question worth separating out:
Q: How should utilities balance modernization with access control today?
A: Utilities should modernize on a long horizon, but they should not wait for replacement before reducing trust. The practical balance is to externalise MFA, segment access to specific assets, record privileged sessions and remove direct exposure now, while capital plans handle device renewal later.
👉 Read our full editorial: Water utilities need brokered access before legacy OT modernization
This post was modified 6 days ago by NHI Mgmt Group