Topic starter
25/10/2026 11:06 am
TL;DR: Exposed controllers and weak control boundaries kept reappearing in water OT incidents, according to Dragos. Water utilities need tighter remote access, segmentation and manual fallback planning to avoid losing operator control.
Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open”.
Key questions
Q: Why do weak credentials and bypassable authentication create outsized OT risk?
A: Because many OT environments rely on devices that are expected to be stable for long periods, so a small authentication failure can persist unnoticed and give an attacker durable control.
Q: How should utilities prioritise OT vulnerabilities when patching is slow?
A: They should prioritise based on whether the asset is reachable, whether the weakness is already known to be exploited, and how much operational impact a compromise would create.
Q: What breaks when OT devices are exposed to the internet?
A: Internet exposure turns HMIs and PLCs into reachable control points rather than protected field assets.
Practitioner guidance
- Remove unnecessary public internet exposure Pull OT controllers, HMIs and related access paths off the public internet wherever they do not have a justified operational need, and replace direct exposure with controlled remote access paths.
- Govern remote access like privileged access Route all vendor and operator remote sessions through managed gateways, restrict device-level credentials, and separate authentication for operators from authentication for plant equipment.
- Build an OT asset exposure inventory Map every externally reachable PLC, cellular endpoint and remote management service so you can see which assets are reachable, by whom and from which networks.
Bottom line: The recurring weakness in these water sector incidents was not novel malware but exposed OT systems and weak control boundaries.
Glossary terms: Loss of Control, Control plane drift, Loss of Visibility, Operational Technology Reachability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Exposed OT connectivity has become a governance failure, not just an architecture choice. Water utilities did not merely inherit internet exposure by accident. They created remote access paths for legitimate operational reasons and then left too many of them insufficiently segmented, monitored or controlled. In that sense, the recurring problem is governance of reachability: who can touch which controller, from where, and under what operational conditions. That is the control boundary that failed at both Bowman and Minnesota.
A question worth separating out:
Q: Should water utilities treat remote access governance as part of operational resilience?
A: Yes. Remote access is not just an IT convenience in water environments. It is part of the operational control plane, so access design, authentication, segmentation and manual fallback planning all affect resilience. If those controls are weak, a connectivity problem can quickly become a service continuity problem.
👉 Read our full editorial: Water utility OT gaps persist from exposed PLCs to loss of control
This post was modified 7 days ago by NHI Mgmt Group