TroutTrout
Back to Blog
WaterRemote Access

SCADA Remote Access for Small Water Utilities

Trout Team2 min read

Secure SCADA remote access for a small water utility means letting an operator or integrator reach the SCADA and PLC systems remotely without a flat VPN, without an agent on the equipment, and with every session recorded. Small systems can do this affordably with a single on-premise access gateway, and it is increasingly what state surveyors and grant programs expect.

Why small utilities need it, and why it is risky

Small water and wastewater systems rarely have 24/7 on-site staff. On-call operators log in from home, and system integrators connect to troubleshoot the SCADA. That access is necessary. The problem is how it is usually done: a VPN into a flat network, often with a shared credential. Once connected, the remote user can reach the HMI, the historian, and every PLC. Several publicized water-sector intrusions have started from exposed or weakly-controlled remote access.

The pattern that works

Put an on-premise access gateway in front of the control network:

  • The operator or integrator connects to the gateway, not to the network.
  • The gateway authenticates them against your identity provider, or acts as the identity and MFA anchor itself if you do not have one, and grants access to only the specific system, for a limited time window.
  • Every session is recorded, so an incident is a lookup, not a forensic exercise.
  • The PLC and HMI install nothing and never change.

The gateway sits in the remote-access path, not the control loop. If it goes offline, on-site operators still run the plant directly from the HMI; only remote access pauses until it is back. That is the honest trade a small system can live with.

This is Zero Trust for the plant, sized for a utility that does not have an OT security team.

Compliance and funding

State drinking-water and wastewater programs increasingly review remote access during surveys, and AWIA risk and resilience assessments call out electronic control systems. Controlled, recorded remote access is a clean way to satisfy that. For New York systems, this work is eligible under the EFC SECURE grant, and it aligns with the NY water cybersecurity rules.

FAQ

Frequently Asked Questions

How does a small water utility give secure remote access to SCADA?
Place an on-premise access gateway in front of the SCADA and PLC network. Operators and integrators connect to the gateway, which authenticates them, grants access only to the specific system for a limited time, and records the session, before any traffic reaches the controller. This replaces a flat VPN that would otherwise expose the whole control network.
Why is a VPN a problem for water SCADA?
A flat VPN extends your network to the remote user: once connected, with no segmentation, they can reach everything, including PLCs and the HMI. A VPN into a segmented DMZ with least-privilege rules is better, but small systems rarely have that. Water-sector incidents have repeatedly started from a shared or reused remote-access credential on a flat network. Regulators increasingly flag flat remote access as a finding.
Is this affordable for a small system?
Yes. The pattern is a single on-premise appliance (or a VM if you already run a hypervisor), no per-endpoint agents, no cloud subscription per asset, and no rip-and-replace of the SCADA. For NY systems it can be funded through the EFC SECURE grant.

Other Articles

CMMCCompliance

The Affirming Official's False Claims Act Risk in CMMC

Under CMMC, a senior company official must affirm the assessment. A false affirmation can expose that person and the company to False Claims Act liability. Here is what the affirming official is actually signing, and how to reduce the risk.

WaterCompliance

AWIA Risk and Resilience Certification: The Cybersecurity Part

AWIA requires community water systems serving more than 3,300 people to assess and certify their risk and resilience, and electronic control systems are explicitly in scope. Here is the cybersecurity part and how to satisfy it.

WaterCompliance

Cybersecurity in the EPA Sanitary Survey: What to Expect

The EPA's 2023 memo tying cybersecurity to sanitary surveys was withdrawn, but state primacy agencies and voluntary guidance are folding it in anyway. Here is what a survey now looks at, and how to prepare.