This Week, Hackers Locked Water Plant Operators Out of Their Own Systems
Over the weekend of July 26-27, 2026, Iranian-affiliated hackers simultaneously breached more than 30 municipal water systems across Minnesota, forcing some communities to issue boil-water notices and switch treatment plants to manual operations.
By July 31st, the FBI and EPA confirmed attacks had expanded to at least seven states, locking water plant operators out of their own control systems by changing passwords and IP addresses on critical industrial equipment.
This isn’t a theoretical threat or a future warning. This happened this week. And if your business uses internet-connected industrial control systems, building management systems, or any form of operational technology (OT)—you’re potentially vulnerable to the exact same attack methods.
Here’s what happened, how the attacks worked, and what CISA, the FBI, and EPA are urgently telling organizations to do right now to prevent similar breaches.
What Happened: Timeline of the July 2026 Water System Attacks
July 22, 2026: CISA Issues Updated Warning
Four days before the coordinated attacks began, the Cybersecurity and Infrastructure Security Agency (CISA) updated Advisory AA26-097A with an urgent warning: Iranian-affiliated actors had been actively compromising internet-connected programmable logic controllers (PLCs) across U.S. water, wastewater, and energy sectors.
The advisory specifically warned about attacks targeting Rockwell Automation and Allen-Bradley industrial controllers.
July 26-27, 2026: Coordinated Attack on Minnesota Water Systems
Over a single weekend, attackers hit water infrastructure across Minnesota:
- More than 30 municipal water and wastewater utilities experienced coordinated cyberattacks
- Four cities publicly disclosed attacks: Braham, Plymouth, South St. Paul, and Maple Plain
- Attackers targeted operational technology controlling water treatment and distribution
- Some utilities forced to switch to manual operations immediately
- At least one community issued precautionary boil-water notices
According to Minnesota IT Services (the state’s technology agency), attacks specifically affected operational technology used by community water utilities—the industrial computers that actually run water treatment plants.
July 30, 2026: FBI and EPA Confirm Multi-State Expansion
- FBI and EPA issued joint public alert confirming attacks in at least seven states (Minnesota plus six others)
- CISA urged immediate action by all water and wastewater utilities nationwide
- Federal agencies described specific attack methods and affected equipment types
- Warnings extended beyond water sector to all organizations using similar industrial control systems
July 31, 2026: Ongoing Federal Investigation
- Attribution under active federal investigation by FBI, CISA, and NSA
- Strong indicators point to Iranian-affiliated APT (Advanced Persistent Threat) actors
- Attack tactics, techniques, and procedures (TTPs) consistent with previous Iranian critical infrastructure campaigns
- Investigation continues into scope, impact, and potential additional targets
How the Attacks Worked: Technical Details
The Targeted Equipment
Attackers specifically targeted internet-facing Programmable Logic Controllers (PLCs) manufactured by Rockwell Automation and Allen-Bradley:
- MicroLogix 1100 and 1400 series — widely deployed in water/wastewater treatment
- CompactLogix family — used across industrial automation
- Micro850 family — popular for smaller installations
What PLCs Actually Do
PLCs are ruggedized industrial computers that automate physical processes. In water treatment systems specifically, they control:
- Pumps and valves regulating water flow
- Chemical treatment dosing (chlorine, fluoride, pH adjustment)
- Pressure monitoring and regulation
- Safety shutdown systems
- Alarm systems for abnormal conditions
- Data displays showing operators what’s happening in real-time
When attackers compromise PLCs, they gain control over the actual physical infrastructure—not just data or computers, but pumps, valves, chemical injectors, and safety systems.
The Vulnerability: CVE-2021-22681
The Critical Flaw Attackers Exploited
- CVE-2021-22681: Insufficiently protected cryptographic key in Rockwell Automation PLCs
- Impact: Allows unauthenticated attackers to impersonate Rockwell engineering software (Studio 5000 Logix Designer) and send malicious commands to PLCs
- Critical limitation: This vulnerability is fundamentally unpatchable due to PLC design architecture
Why this can’t be patched: The cryptographic weakness is baked into the hardware and firmware architecture. Rockwell cannot fix it via software update without replacing the entire PLC.
This vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in March 2026 after confirmed in-the-wild exploitation by Iranian-affiliated actors began.
The Attack Chain: Step-by-Step Breakdown
Step 1: Discovery and Reconnaissance
Attackers scanned the internet systematically for exposed industrial control systems:
- Identified PLCs with public IP addresses (directly accessible from internet)
- Fingerprinted specific Rockwell Automation / Allen-Bradley models
- Mapped network architecture and identified systems with insufficient security controls
Step 2: Initial Access via CVE-2021-22681
- Exploited cryptographic weakness to impersonate legitimate Rockwell engineering software
- No authentication required—vulnerability allows unauthenticated access
- Bypassed what limited access controls existed on target systems
Step 3: Malicious Modifications to Control Systems
According to FBI analysis of compromised systems, attackers systematically:
Changed PLC IP addresses
- Made devices harder for legitimate operators to locate and manage
- Disrupted monitoring and management systems
- Created confusion during incident response
Set new passwords and locked out operators
- Changed administrative passwords to values only attackers knew
- Locked legitimate plant operators out of their own equipment
- Prevented operators from making emergency configuration changes
Modified ladder logic (PLC programming code)
- Disabled safety shutdown systems
- Disabled alarm systems that would alert operators to problems
- Maintained normal appearance to downstream monitoring systems
- Created hidden backdoors for persistent access
Manipulated HMI (Human-Machine Interface) and SCADA displays
- Showed operators false “everything is normal” data
- Hid evidence of tampering and malicious modifications
- Prevented operators from recognizing system compromise until too late
Step 4: Operational Disruption and Impact
- Operators lost visibility into what treatment systems were actually doing
- Operators lost control of equipment they’re responsible for managing
- Safety systems disabled without operators’ knowledge or consent
- Some systems forced completely offline to prevent further damage
- Manual operations required (where even possible without automated controls)
Why These Attacks Succeeded: Root Causes
According to joint analysis by CISA, FBI, and EPA, the Minnesota attacks (and similar incidents in six other states) succeeded because of predictable, preventable security failures.
Root Cause #1: PLCs Directly Exposed to the Internet
The fundamental problem: Industrial control systems accessible from the public internet with no firewall protection between PLCs and external attackers.
Why this is catastrophic: PLCs were designed in the 1960s-1990s for closed, trusted industrial networks. They assume every device that can connect to them is authorized and trustworthy. They have minimal built-in security controls.
Exposing PLCs directly to the internet is like leaving your manufacturing floor or water treatment plant unlocked and accessible to anyone worldwide with an internet connection.
Root Cause #2: Insufficient Network Segmentation
Common architectural failure:
- Operational Technology (OT) networks not isolated from IT networks
- No DMZ (demilitarized zone) for any required remote access
- Flat network architecture allowing unrestricted lateral movement
- Direct paths from internet to industrial control systems
Result: Attackers who gain access to any network-connected device can potentially reach critical industrial controllers.
Root Cause #3: Default and Weak Credentials
Authentication failures observed:
- Default passwords unchanged from factory settings
- Weak passwords easily guessed or brute-forced
- Shared passwords across multiple critical systems
- No multi-factor authentication (MFA) even where technically possible
Many industrial systems ship with well-known default credentials like “admin/admin” or “1234”. If these aren’t changed during installation, anyone who knows the defaults can access the systems.
Root Cause #4: Lack of Monitoring, Logging, and Detection
Visibility gaps that enabled prolonged compromise:
- No logging of PLC configuration changes
- No alerts for password modifications or access control changes
- No visibility into unauthorized access attempts
- No anomaly detection for unusual command patterns
- No regular audits of system configurations
The pattern: These are the exact same fundamental security failures that enabled the 2023 Unitronics water system attacks, numerous manufacturing facility breaches, and countless other industrial control system compromises over the past decade.
Internet exposure + weak authentication + poor segmentation + no monitoring = guaranteed eventual compromise.
Operational Impact: What Actually Happened to Water Systems
Direct Effects Documented
- Loss of visibility: Operators couldn’t see what their treatment systems were actually doing in real-time
- Loss of control: Operators completely locked out of equipment they’re responsible for safely managing
- Safety system failures: Shutdown and alarm systems disabled without operators’ knowledge
- Manual operations required: Staff forced to operate treatment plants manually using physical controls and gauges
- Boil-water notices issued: Some communities issued public health warnings due to potential contamination risk from loss of automated treatment controls
- Service disruption: Normal water treatment and distribution operations interrupted
Intended Impact (Per Minnesota Bureau of Criminal Apprehension Assessment)
According to the Minnesota BCA memo distributed to local authorities:
- Loss of system pressure (creates contamination risk by allowing external pollutants to enter distribution pipes)
- Potential contamination of public water supply through improper chemical dosing or treatment failures
- Extended service disruption affecting public health and safety
- Erosion of public confidence in critical infrastructure security
- Demonstration of vulnerability to encourage future attacks
What Didn’t Happen (But Could Have)
- No confirmed water contamination incidents reported (as of July 31st)
- No long-term infrastructure damage or equipment destruction
- No casualties, illnesses, or public health emergencies
- No permanent loss of control or treatment capabilities
Why limited impact: Most affected utilities successfully switched to manual operations quickly enough to prevent worst-case contamination scenarios. Staff training, documented emergency procedures, and quick response prevented catastrophic outcomes.
But relying on quick manual response during active cyberattacks isn’t a security strategy—it’s luck. If attacks had been more sophisticated or simultaneous across more systems, outcomes could have been dramatically worse.
This Isn’t Just About Water: Who Else Is Vulnerable
If you’re thinking “we’re not a water utility, this doesn’t apply to our business”—that’s exactly the dangerous misconception attackers count on.
The attack methods used against Minnesota water systems work against any organization using similar internet-exposed industrial control systems.
Manufacturing and Industrial Facilities
Vulnerable systems:
- PLCs controlling production lines and assembly systems
- Automated manufacturing equipment and robotics
- Chemical processing and mixing systems
- Food and beverage production controls
- Pharmaceutical manufacturing automation
- Quality control and testing equipment
Potential attack impact: Production stoppages, safety system failures, product contamination, equipment damage, supply chain disruption, financial losses.
Energy Sector
Vulnerable systems:
- Power generation facility controls
- Oil and gas pipeline automation
- Refining and processing operations
- Distribution grid control systems
- Renewable energy system controllers
Potential attack impact: Power outages affecting thousands or millions, safety incidents, environmental disasters, economic disruption, cascading infrastructure failures.
Building Management Systems
Vulnerable systems:
- HVAC (heating, ventilation, air conditioning) control systems
- Physical security systems (access control, surveillance cameras)
- Fire suppression and life safety systems
- Elevator and escalator controls
- Lighting and energy management automation
- Data center cooling and environmental controls
Potential attack impact: Loss of climate control (health risk in extreme weather), security system failures, safety system malfunctions, tenant health and safety incidents, business operations disruption.
Transportation and Logistics
Vulnerable systems:
- Traffic signal and intelligent transportation systems
- Transit operations and control systems
- Warehouse automation and material handling
- Fleet management and logistics systems
- Parking management and access control
Potential attack impact: Traffic disruptions, transit service failures, safety incidents, supply chain interruptions, economic losses.
The Common Thread
Any organization using industrial PLCs, SCADA systems, building management controllers, or operational technology that is internet-accessible—either directly or through poorly segmented networks—faces fundamentally the same vulnerabilities that enabled the Minnesota water system attacks.
Attackers don’t care what industry you’re in. They scan the entire internet for vulnerable systems and exploit whatever they find.
CISA, FBI, and EPA Recommended Mitigations (What to Do Right Now)
Federal agencies issued urgent guidance for immediate action. These aren’t suggestions or future best practices—they’re emergency mitigation steps organizations should implement immediately.
Priority 1: Disconnect PLCs from the Internet Immediately
CISA’s explicit directive: Disconnect all programmable logic controllers from direct internet access right now. Today.
Why this is non-negotiable: PLCs were not designed to be internet-facing devices. They lack robust security controls, assume trusted network environments, and should never be directly accessible from the public internet under any circumstances.
How to implement:
- Identify all internet-facing PLCs and industrial controllers (scan your public IP ranges, review firewall rules, audit network diagrams)
- Remove direct public IP addresses from all industrial control devices
- Block internet-bound traffic from OT networks at firewall level
- Document all changes and verify effectiveness through testing
- Confirm no alternative paths to internet exist (wireless bridges, cellular modems, vendor backdoors)
If immediate disconnection isn’t operationally feasible: Implement emergency compensating controls (strict firewall rules, VPN-only access, enhanced monitoring) while working urgently toward complete disconnection. But understand this is temporary risk acceptance, not a permanent solution.
Priority 2: Implement Secure Remote Access (Never Direct PLC Connections)
The absolute requirement: Remote access must NEVER connect directly to PLCs from the internet.
Proper Secure Remote Access Architecture
Use VPN with strong authentication:
- Multi-factor authentication (MFA) required for all remote access without exception
- Strong unique passwords (minimum 16 characters, high complexity)
- Regular mandatory credential rotation (quarterly at minimum)
- Modern VPN protocols (WireGuard, OpenVPN, IPsec—not PPTP or L2TP)
- Certificate-based authentication where technically possible
Implement jump server / gateway architecture:
- Remote access terminates at hardened bastion host in isolated DMZ network
- Gateway connects to OT network through strictly controlled firewall rules
- All access logged comprehensively with tamper-proof logging
- Session recording for forensic analysis and accountability
- Time-limited access (automatic session termination, scheduled access windows)
Network segmentation requirements:
- Complete isolation of OT network from IT corporate network
- Firewall rules restricting traffic flow to minimum necessary
- No direct network paths from internet to any control system
- DMZ for any required cross-network communication
- Regular audit of network architecture and firewall rules
Priority 3: Change All Default and Weak Credentials Immediately
Immediate mandatory actions:
- Change every single default password on every PLC, HMI, SCADA system, and industrial network device
- Implement strong unique passwords for each system (16+ characters, high complexity, no dictionary words)
- Use enterprise password manager for secure credential storage and auditing
- Document credential change procedures and maintain secure offline backup
- Implement regular credential rotation schedule (quarterly minimum, more frequently for high-value systems)
For Rockwell Automation equipment specifically:
- Enable all available authentication and access control features
- Restrict access to absolute minimum necessary user accounts
- Review and comprehensively audit user accounts regularly
- Disable or remove unnecessary default accounts
- Monitor for unauthorized account creation or modification
Priority 4: Implement Network Segmentation and Comprehensive Monitoring
Network Architecture Requirements
Complete OT/IT network separation:
- Physically or logically isolated OT network with absolutely no direct internet connectivity
- Firewall between OT and IT networks with default-deny rules
- DMZ for any required cross-network communication with strict controls
- Unidirectional gateways (data diodes) where appropriate for one-way data flow
- Regular penetration testing to validate segmentation effectiveness
Monitoring and logging requirements:
- Comprehensive logging of all PLC configuration changes
- Immediate alerts on password modifications or access control changes
- Monitoring and alerting for unauthorized access attempts
- Long-term log retention for forensic analysis (minimum 90 days, preferably 1 year)
- Implement intrusion detection systems (IDS) specifically designed for OT networks
- Security Information and Event Management (SIEM) integration for correlation
- Regular review of logs and alerts for suspicious patterns
Priority 5: Audit and Harden All Existing OT Deployments
Comprehensive inventory and assessment:
- Complete OT asset inventory: Document every PLC, HMI, SCADA workstation, industrial network switch, and control system component
- Document make, model, firmware version: Identify what you have and what vulnerabilities may exist
- Identify all internet-facing devices: Map which systems are exposed and how
- Map network connectivity: Understand how systems connect and where data flows
- Document dependencies: Identify critical paths and single points of failure
Configuration review and hardening:
- Audit for default settings still in place
- Identify and disable unnecessary services and protocols
- Verify remote access is properly secured (or disabled if not needed)
- Apply firmware updates where patches available (test thoroughly in non-production first)
- Review vendor security advisories and implement recommended mitigations
Incident response preparation and testing:
- Document manual operation procedures for when automation fails
- Store backup PLC configurations securely offline
- Document and regularly test recovery procedures
- Train staff on emergency response protocols
- Conduct tabletop exercises simulating OT security incidents
- Establish communication plans for coordination during incidents
What This Means for Your Business: Decision Framework
Critical Questions to Ask About Your Organization
✓ Do we use PLCs, SCADA systems, or building management systems for any operational purpose?
Consider:
- Manufacturing automation and production controls
- Building management (HVAC, security, fire suppression, elevators)
- Process control and quality systems
- Any critical infrastructure or operational technology
✓ Are any industrial controllers or building systems internet-accessible?
Check for:
- Direct public IP addresses on control systems
- Remote access for vendor support or maintenance
- Cloud-connected monitoring or management dashboards
- Mobile app connectivity for system management
- Wireless or cellular connections to control systems
✓ Have we changed default credentials on all operational technology equipment?
Verify:
- PLCs and industrial controllers
- HMI workstations and operator interfaces
- SCADA servers and engineering workstations
- Industrial network switches, routers, and firewalls
- Building management system controllers
✓ Is our OT network properly segmented from our IT corporate network?
Assess:
- Physical or logical network separation
- Firewall rules explicitly restricting traffic flow
- No direct network paths from internet to control systems
- DMZ architecture for any required cross-network communication
✓ Do we comprehensively log and monitor OT system access and configuration changes?
Confirm:
- Configuration change logging enabled and reviewed
- Access attempt monitoring and alerting
- Automated alerts on unauthorized modifications
- Regular security log review and analysis
If you answered “no” or “I don’t know” to any of these questions, you likely have critical vulnerabilities requiring immediate attention.
Why Many Businesses Don’t Know They’re Vulnerable
Dangerous Misconceptions
Misconception #1: “We’re not critical infrastructure, so attackers won’t target us”
Reality: Attackers scan the entire internet systematically for vulnerable systems using automated tools. They don’t manually choose targets based on criticality—they exploit whatever vulnerable systems they find.
If your PLCs are internet-accessible with default credentials, attackers will find them and compromise them regardless of whether you’re a water utility, manufacturing plant, office building, or warehouse.
Misconception #2: “Our building management vendor handles security for those systems”
Reality: Most BMS vendors prioritize functionality, uptime, and ease of access over security. Default credentials, internet exposure, and weak network segmentation are disturbingly common in vendor-managed systems.
Vendors often implement remote access for their own convenience (remote support, monitoring, maintenance) without proper security controls. You cannot outsource responsibility for critical system security to vendors who may not prioritize it.
Misconception #3: “Our OT systems are air-gapped from the internet, we’re safe”
Reality: Many supposedly “air-gapped” operational technology systems have hidden internet connections nobody documented:
- Vendor remote access portals for support and maintenance
- Cloud-connected monitoring dashboards and mobile apps
- Wireless bridges installed for “convenience”
- IT network connectivity providing indirect internet access
- Cellular modems for remote sites or backup connectivity
Unless you’ve recently conducted a comprehensive network audit specifically looking for these connections, you cannot safely assume your OT systems are truly isolated.
Misconception #4: “We would know if something was wrong with our control systems”
Reality: The Minnesota water system attackers specifically manipulated HMI displays to show normal operations while disabling safety systems in the background. Operators saw “everything looks fine” on their screens while attackers were actively modifying critical configurations.
Modern OT attacks are sophisticated enough to hide their presence. You might not discover compromise until something catastrophic happens or until attackers choose to reveal themselves by locking you out.
Common Questions About OT Security
Q: Can We Just Patch the Rockwell PLC Vulnerability and Be Safe?
A: No. CVE-2021-22681 is fundamentally unpatchable due to the PLC hardware and firmware design architecture. Rockwell Automation cannot fix this vulnerability via software update without completely replacing the affected PLCs.
The only effective mitigation is removing PLCs entirely from internet exposure and implementing proper network segmentation. Even if this specific vulnerability were patchable, the broader lesson is that PLCs should never be internet-accessible regardless of patch status.
Q: Our Vendor Requires Remote Access for Support—How Do We Handle That Securely?
A: Implement proper secure remote access architecture that doesn’t involve direct internet exposure of PLCs:
- VPN with mandatory multi-factor authentication to hardened jump server in isolated DMZ
- Time-limited access enabled only during active support sessions
- Comprehensive monitored and logged access for accountability
- Vendor connects to jump server, which then connects to OT network—never direct PLC access from internet
- Automatically disable remote access when support session completes
- Regular audit of vendor access patterns and permissions
Never give vendors direct internet access to PLCs under any circumstances. If a vendor insists this is required, they’re prioritizing their convenience over your security. Find a different vendor or impose strict security requirements.
Q: How Do We Find Out If Our PLCs or Building Systems Are Internet-Facing?
A: Systematic discovery and audit:
- Scan your public IP address ranges for industrial protocols (Modbus, EtherNet/IP, BACnet, etc.)
- Review firewall rules comprehensively for allowed traffic to OT networks
- Check router and firewall configurations for port forwards to control systems
- Ask vendors and system integrators explicitly about remote access mechanisms they implemented
- Use vulnerability scanning tools specifically designed for OT environments (Nessus, Tenable.ot, Claroty)
- Conduct network traffic analysis to identify unexpected external communications
- Review cloud service subscriptions for connected systems you didn’t know existed
You might be surprised (and alarmed) by what you discover. Many organizations find internet-connected control systems they had no idea were exposed.
Q: This Seems Expensive and Disruptive—Do We Really Need to Do This?
A: Ask yourself these questions:
- What’s the cost if your production line stops for a week while you recover from ransomware?
- What’s the liability if your building HVAC fails in summer heat and someone gets seriously ill?
- What’s the regulatory and legal exposure if a safety system doesn’t activate when needed?
- What’s the impact if your manufacturing process is sabotaged and produces contaminated products?
The Minnesota water system attacks forced manual operations, boil-water notices, and public health warnings. Manufacturing plants could lose millions in production and product recalls. Building system failures could create health emergencies and massive liability.
Prevention is dramatically cheaper than incident response, recovery, liability, and reputational damage.
Q: Where Do We Even Start If We Don’t Have OT Security Expertise In-House?
A: Start with the immediate priorities in order:
- Identify what OT systems you have and where they are (you can’t secure what you don’t know exists)
- Disconnect internet-facing PLCs immediately (emergency mitigation while you plan proper architecture)
- Change all default credentials (quick win that significantly reduces risk)
- Engage qualified OT security experts to assess your environment and implement proper security architecture
Do not delay steps 1-3 while planning step 4. Identify, disconnect, and change credentials immediately. Then bring in expertise for comprehensive assessment and long-term security architecture.
The Bottom Line
Iranian-affiliated hackers just demonstrated—again—that critical infrastructure control systems are vulnerable and actively targeted when they’re internet-accessible, poorly segmented, and running with default or weak credentials.
More than 30 Minnesota water systems were breached in a single coordinated weekend attack. The FBI confirms similar attacks in at least seven states total. CISA, the FBI, and EPA are urgently warning all organizations with operational technology systems to take immediate action.
If your business uses PLCs, SCADA systems, building management controllers, or any form of industrial automation:
- Audit whether they’re internet-accessible (you might be surprised and alarmed by what you find)
- Disconnect them from direct internet access immediately as emergency mitigation
- Implement proper secure remote access architecture (VPN, jump servers, network segmentation)
- Change all default and weak credentials to strong unique passwords
- Audit and comprehensively monitor OT systems for unauthorized access and configuration changes
- Prepare incident response procedures including manual operation capabilities
Don’t wait for attackers to lock you out of your own equipment before discovering you had critical internet-facing vulnerabilities you didn’t know existed.
The Minnesota water utilities didn’t know they were vulnerable until operators couldn’t access their own treatment systems and communities had to issue boil-water notices. Manufacturing plants have lost millions to similar attacks. Building systems have failed catastrophically.
Learn from their experience. Act now before you become the next headline.
Need Help Securing Your Operational Technology Environment?
Identifying internet-facing PLCs, SCADA systems, and building management controllers you didn’t know were exposed, implementing proper network segmentation between operational technology and IT networks, designing secure remote access architecture that enables necessary vendor support without direct PLC exposure, comprehensively auditing industrial and building control system configurations and security posture, and building practical OT security programs that balance operational requirements with security best practices—that’s exactly where most businesses get stuck and need expert guidance.
At Castle Rock Sky, we help Denver metro businesses assess operational technology security posture, identify critical infrastructure vulnerabilities before attackers exploit them, and implement practical security controls that protect industrial control systems and building management systems without disrupting essential operations.
We can help with:
- OT security assessment and vulnerability identification — discover what internet-facing control systems you have, where exposure exists, and what risks require immediate mitigation
- Network segmentation architecture design and implementation — properly isolate OT networks from IT corporate networks and eliminate direct internet exposure
- Secure remote access implementation — enable necessary vendor support and remote management without exposing PLCs directly to internet
- Credential management and system hardening — systematically eliminate default passwords, implement strong authentication, and harden control system configurations
- Monitoring and detection deployment — implement comprehensive logging, alerting, and monitoring for unauthorized OT system access and configuration changes
- Incident response planning and testing — prepare for OT security incidents with documented manual operation procedures, recovery plans, and tabletop exercises
- Ongoing OT security program management — quarterly assessments, continuous monitoring, vulnerability management, and security maintenance
- Compliance and regulatory guidance — meet TSA, NERC-CIP, NIST, and other critical infrastructure security requirements
Don’t wait for a coordinated attack to discover your building management system, manufacturing process controls, or industrial automation equipment is directly accessible from the internet with default credentials still in place.
The Iranian water system attacks that just hit 30+ Minnesota utilities this week used predictable, well-known attack methods against preventable vulnerabilities. Your control systems might be next if you don’t act now.
