Topic starter
11/07/2026 8:39 pm
TL;DR: Water utilities face easy lateral movement because flat networks, weak authentication, and limited OT visibility leave internal trust too broad, according to Elisity. Segmentation and access governance now have to shrink the reach an intruder gets after any initial foothold.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “EPA Unveils Critical Cybersecurity Planning Tools to Protect Water Systems from Rising Cyberattacks”.
Key questions
Q: Why do default passwords create such high risk in water infrastructure?
A: Default passwords turn exposed devices into easy entry points, especially where legacy OT systems lack MFA or modern session controls.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.
A: Organisations should isolate OT from IT with segmentation that limits lateral movement, then add tightly controlled pathways for monitoring, maintenance, and approved business traffic.
Practitioner guidance
- Map IT-to-OT trust paths Document every path by which an IT foothold can reach SCADA, PLC, RTU, HMI, and vendor-managed systems, then remove or isolate paths that are not operationally required.
- Eliminate default and shared credentials Reset factory passwords, remove shared logins where possible, and enforce unique account ownership for operators, administrators, and third-party support access.
- Build a living asset inventory Continuously identify devices, identities, and communication flows so segmentation policies can be based on actual dependencies rather than assumed architecture.
Bottom line: Water utility risk is driven less by exotic exploits than by over-trusted internal connectivity, weak authentication, and limited OT visibility.
Glossary terms: Lateral Movement, Operational Technology, Microsegmentation, Standing Trust
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 45 minutes ago by NHI Mgmt Group
11/07/2026 9:07 pm
Flat-network lateral movement is the core governance failure in water utility cyber risk. The article is not really about one tool or one alert condition. It shows that once IT and OT trust each other too broadly, attackers can move from ordinary footholds into control environments that were never meant to be reachable in that way. For practitioners, segmentation is a governance control, not just a network design choice.
A question worth separating out:
Q: How should water utilities prioritise response planning versus containment controls?
A: Utilities should treat containment controls as the prerequisite for effective response, not a replacement for it. Incident plans help teams recover, but if lateral movement is unconstrained, response teams will face a much larger and less predictable problem. The right sequence is to reduce internal reach first, then rehearse recovery around the smaller blast radius that remains.
👉 Read our full editorial: Water utility cyber resilience gaps are forcing new segmentation models