Topic starter
24/10/2026 8:49 pm
TL;DR: Xage Security argues that U.S. water and wastewater utilities keep facing the same failure pattern: legacy PLCs and HMIs cannot verify identity, while overly trusted connections and standing access turn reachability into control authority. The practical answer is to externalise MFA, least privilege and just-in-time access in front of devices that cannot secure themselves.
Editorial analysis by NHI Mgmt Group, based on content published by Xage Security: “Breaking the Water Cyberattack Cycle”.
Key questions
Q: What breaks when legacy PLCs and HMIs cannot enforce identity controls?
A: When legacy OT devices cannot verify users or applications, the control point moves outside the device.
Q: Why do standing OT access paths increase operational risk?
A: Standing access turns remote maintenance and supplier convenience into persistent trust.
Q: What are the signs that OT access governance is not keeping up?
A: Look for overlapping VPN access paths, shared accounts across vendors and internal staff, incomplete session logs, and maintenance workflows that cannot show when access started or ended.
Practitioner guidance
- Externalise identity and MFA in front of legacy assets Put an enforcement layer between users and PLCs, HMIs or remote field devices so named identity, MFA and policy are checked before access reaches the controller.
- Replace standing remote access with just-in-time approval Grant vendor and engineer access only for a specific asset and task window, then remove it automatically when the work ends.
- Record and review privileged OT sessions Capture what was connected, what tool was used, what file changed and which controller received the change so engineering activity stays auditable.
Bottom line: Legacy water-sector OT is vulnerable not simply because the assets are old, but because too much authority is still granted through the access path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →