Why do weak segmentation and insecure remote access increase risk in water utilities?

How weak segmentation turns a normal remote connection into OT access

In water utilities, weak segmentation matters because the network path that supports ordinary administration can become the same path that reaches control systems. If IT, vendor, and OT traffic are not separated with clear policy boundaries, a compromise at the remote access layer can move laterally into engineering workstations, HMIs, historians, or other systems that influence operations. That is why the boundary itself is a control, not just an architecture preference.

Segmentation also shapes how far an intrusion can travel after the first login succeeds. A well-designed OT boundary should force traffic through limited, monitored conduits rather than allowing broad routable access into supervisory networks. When that design is missing, one stolen credential, one exposed remote desktop path, or one overtrusted vendor tunnel can expose far more of the plant than the original account should ever touch. For a sector-specific treatment of this problem, see the Water and Wastewater Cybersecurity Guide.

Segmentation failures are especially dangerous in operational environments because the network boundary often doubles as a safety boundary. If access reaches control-plane assets that manage pumps, valves, chemical dosing, alarms, or setpoints, then a cyber incident is no longer just an IT event. It becomes a process integrity issue, where the attacker does not need to destroy systems to cause harm, only to change what operators see or what controllers execute.

Why insecure remote access is a high-value entry path

Remote access is attractive because it is designed to bypass distance and time, which also makes it attractive to attackers. If remote connectivity is protected only by passwords, shared accounts, stale VPN entitlements, weak MFA coverage, or poorly governed vendor access, the entry path becomes easier to abuse than on-site access. In practice, insecure remote access often creates the first foothold that segmentation is supposed to contain, but cannot if the internal boundary is too flat.

Water utilities often depend on remote access for vendors, integrators, managed service providers, and after-hours support. That dependency is legitimate, but it increases risk when access is persistent, poorly reviewed, or broader than the task requires. The security problem is not remote access itself, it is remote access that behaves like a standing internal bridge. The Remote Access Identity Guide is useful here because it frames remote access around MFA on every entry point, ZTNA, device posture, and retiring dormant VPN accounts.

In OT and water environments, a remote session should be treated as a controlled exception, not a general-purpose route into the plant. Where organisations allow vendors to reach internal systems directly, or reuse the same remote pathway for many assets, they increase the chance that a compromised laptop, stolen session, or abused account can reach systems that were never meant to be internet-adjacent.

What changes when an attacker reaches HMIs and PLCs

Once an attacker or unauthorised user can cross that boundary, the consequences depend on what the remote path can touch. HMIs can be manipulated to mislead operators, PLCs can be used to alter process logic, and related systems can be used to hide alarms, delay response, or change operating conditions. Even small changes can matter because industrial control is about timing, state, and coordination, not just data loss.

This is why water utilities care about both visibility and command integrity. An attacker may not need to take systems offline to create damage, and an operator may not immediately know that a command, configuration, or displayed value has been altered. If the environment allows remote access to engineering stations or controller administration paths, the compromise can progress from access abuse to process manipulation very quickly.

The issue is not limited to outright sabotage. A remote foothold can also create service continuity risk, for example by disabling alarms, interrupting telemetry, or forcing operators into manual workarounds. That is why OT security guidance emphasises segmentation, restricted conduits, and tightly governed remote administration rather than simple perimeter defence. The OT Security Guide and the NIST SP 800-82 Rev 3 OT Security Guide both support that operational model.

Risk and Threat Considerations

Weak segmentation and insecure remote access create a classic blast-radius problem: the same path that was supposed to support administration can become a path into control, monitoring, and safety-adjacent systems. In water utilities, that increases the likelihood that a routine access compromise becomes an OT incident instead of a contained IT event.

Failure mechanism: An attacker or unauthorised user obtains a valid remote entry point, then uses flat internal routing, excessive trust, or weak boundary controls to reach higher-value OT assets and issue commands, change logic, or disrupt operator visibility.

Impact: The result can be unsafe process changes, loss of service continuity, equipment stress, or operator confusion, especially when HMIs and PLCs are reachable from the same remote path as ordinary administrative systems.

Practitioner Guidance

What to verify: Confirm that remote access into water or wastewater environments is segmented by function, identity, and asset class, not just by network location. If a vendor or admin path can reach multiple zones without mediation, treat that as an exposure that needs redesign, not just monitoring.

Decision rule: If a remote session can authenticate into OT-adjacent systems, require strong MFA, device posture checks, and narrow destination scoping before you trust the access model. If the same credential or tunnel can reach both administrative and control systems, the environment still has a privilege boundary problem even if it has firewalls.

Practitioner takeaway: The practical goal is not to eliminate remote access, it is to make sure remote access cannot silently become control-system access with a much larger blast radius than the business intended.

Related resources from NHI Mgmt Group

• Why does weak remote access governance increase the risk of phishing, unauthorized access, and ransomware?
• Why do weak patching and legacy remote access increase cyber insurance underwriting risk?
• Why do weak cloud remote access controls increase breach risk?
• Why does remote vendor access increase risk in industrial environments?