What are common mistakes with water utility cybersecurity?

What water utility teams most often get wrong

In water environments, the most common failures are architectural rather than exotic. Weak remote access, shared accounts, flat routing between business IT and control environments, and overexposed engineering workstations create paths that bypass the normal safety and operations checks. If an attacker, contractor, or misconfigured tool can reach control assets directly, the rest of the security stack becomes harder to rely on.

That is why the core problem is not just “better passwords”, but reducing the number of ways an external or internal user can talk to treatment and distribution systems. A useful baseline is the OT Security Guide, which frames segmentation, conduits, and industrial remote access as the first line of defence for SCADA and related environments.

Why SCADA and engineering systems are so easy to overexpose

Water utilities often inherit technology that was designed for availability and operational convenience, not hostile-network assumptions. Vendor support paths, remote maintenance channels, historian access, and engineering workstations tend to accumulate exceptions over time. The result is that the most sensitive commands can end up reachable from places that were never meant to touch process control.

Common mistakes include leaving remote access broadly open to the internet, trusting a small set of shared administrative credentials, and allowing vendors or operators to jump into control networks without strong separation. In practice, that means an attacker does not need to “break” the plant if they can simply find the path that already exists. Threat advisories from CISA cyber threat advisories repeatedly emphasise the same lesson: exposed critical infrastructure systems are attractive precisely because remote access and trust relationships are often the weakest layer.

Monitoring matters because process compromise rarely looks like classic office IT abuse. Unexpected setpoint changes, unusual pump starts and stops, and chemical dosing commands outside the expected operating pattern are the kinds of signals that tell operators the environment is no longer behaving normally. That operational visibility is more valuable than simply counting alerts.

What good practice looks like in a water utility

Good practice starts with narrowing trust boundaries. Segment SCADA, engineering workstations, historian systems, and corporate IT so that compromise in one zone does not automatically expose the others. Remote access should be brokered, limited, and reviewed, with vendor connectivity treated as a controlled exception rather than a standing entitlement.

For critical infrastructure teams, CISA’s Industrial Control Systems resources are useful because they reinforce the same operational priorities: restrict reachability, reduce unnecessary pathways, and preserve manual control options when automation or communications fail. In a water plant, the question is not whether remote access is useful, but whether every access path is necessary, monitored, and recoverable.

Testing manual fallback procedures is part of the control, not an afterthought. If operators cannot safely run the plant when remote tools, HMI links, or network connections are disrupted, then resilience is still incomplete. The strongest posture combines segmentation, least-privilege access, and rehearsed manual operation rather than depending on any single monitoring layer.

Risk and Threat Considerations

Water utilities face both safety and security exposure when control systems are reachable through weak remote access or shared credentials. The threat is not only theft of information, but manipulation of physical processes, including pump operation and chemical dosing, which can create service disruption or unsafe operating conditions.

Failure mechanism: Attackers, contractors, or compromised third-party tools can abuse exposed access paths to issue legitimate-looking control commands, especially when network separation is weak and identities are shared or poorly governed.

Impact: The likely outcomes are operational disruption, loss of confidence in process readings, delayed response to abnormal conditions, and in the worst case, direct interference with treatment or distribution integrity.

Practitioner Guidance

What to prioritise: Treat remote access review as a plant-safety activity, not only an IT control review. Start with the paths that can reach engineering workstations, SCADA servers, and vendor maintenance channels, then remove anything that is not clearly required.

What to verify: Confirm that every privileged control path is individually accountable, that shared credentials are being eliminated, and that network boundaries actually prevent direct reachability into control segments. If a path can be used after hours without a change record or operator awareness, it is probably too permissive.

Practitioner takeaway: In water utilities, the highest-value security work is usually the unglamorous work of reducing reachability, removing shared trust, and proving that operators can still control the plant when automation or connectivity fails.

Related resources from NHI Mgmt Group

• What are common mistakes with Material Cybersecurity Incident?
• Why does water utility cybersecurity matter for security teams?
• What are the key water utility cybersecurity best practices?
• What are common mistakes with maritime cybersecurity?