SCADA Security for Water Systems: What a Small Utility Can Do This Year

SCADA security for a water system comes down to one thing: controlling who and what reaches the controllers, because the controllers themselves cannot be patched or rebooted on a schedule. A small utility can do that this year with one on-premise appliance at the plant: every remote session brokered and recorded, every controller behind a checkpoint, nothing installed on the PLCs or the HMI. It is what state surveyors and grant programmes increasingly expect, and for New York systems it is fundable.

Five Incidents That Changed Water Utility Cybersecurity

Water utilities have historically operated under the assumption that they are too small, too local, and too low-profile to be targeted. Five incidents in four years proved that wrong, and each one exposed a different failure mode that the industry is still catching up to.

Upcoming webinars: the Trout team runs live sessions on securing water and wastewater OT and New York's new DEC and DOH cybersecurity rules. See the schedule and register on the webinars page.

1. Oldsmar, Florida (February 2021), The Wake-Up Call

An attacker remotely accessed the SCADA system at the Oldsmar water treatment plant and attempted to increase sodium hydroxide (lye) levels from 100 ppm to 11,100 ppm, a concentration that would have poisoned the water supply. An operator noticed the mouse moving on the HMI and intervened.

The attack used TeamViewer with shared credentials. No advanced exploit. No zero-day. Just remote access software with a known password.

What Oldsmar taught the industry: Remote access with shared credentials is not a theoretical risk, it is an open door. The attacker did not need to hack anything. They logged in. The fix is not better passwords; it is identity-based, MFA-protected, session-recorded remote access where every connection is attributed to a specific person.

2. South Staffordshire Water, UK (August 2022), IT to OT in One Step

The Cl0p ransomware group breached the IT network at South Staffordshire Water and claimed access to SCADA systems controlling water treatment. Whether they actually reached SCADA or not, the incident exposed a structural problem: the IT and OT networks were close enough that a ransomware group could credibly claim to have crossed the boundary.

What South Staffordshire taught the industry: If your IT and OT networks are not segmented, an IT breach is an OT breach. Treatment plant SCADA, pumping station RTUs, and corporate email should never share the same network. Chemical dosing controllers should not be reachable from the email server.

3. Aliquippa, Pennsylvania (November 2023), Nation-State Actors Hit Small Utilities

Iran-linked CyberAv3ngers compromised a Unitronics PLC at a water authority booster station. The default password "1111" was never changed. The attackers defaced the HMI with an anti-Israel message, but they had full control of the PLC, they could have changed pump operations.

What Aliquippa taught the industry: Nation-state groups are not just targeting large utilities. A small municipal water authority with a single booster station was hit because it had a PLC exposed to the internet with a default password. The fix is not more monitoring, it is ensuring that no OT device is directly reachable from the internet, and that no default credential survives commissioning.

4. Volt Typhoon Pre-Positioning (2024), The Threat You Cannot See

CISA and EPA issued joint advisories after discovering that Chinese state-sponsored actors (Volt Typhoon) had pre-positioned access in multiple US water utility networks. These were not smash-and-grab attacks. The adversary had established persistent, quiet access, sitting inside utility networks for months, mapping systems, and maintaining the ability to disrupt operations on command.

What Volt Typhoon taught the industry: You cannot rely on detecting attacks in progress. A well-resourced adversary will sit quietly inside your network until they choose to act. The defense is not better detection, it is network architecture that limits what an attacker can reach even after they get in. Every pump station needs its own encrypted tunnel to the SCADA server. A compromised RTU at one site should not be able to reach any other site.

5. The Regulatory Response (2023-2025), Enforcement Arrives

The incidents above triggered a wave of regulatory action. The EPA began using its authority under the Safe Drinking Water Act to push cybersecurity requirements through sanitary surveys. CISA issued multiple advisories specifically targeting water sector vulnerabilities. The EU's NIS2 Directive explicitly listed water supply and wastewater as essential entity sectors, with enforcement now live.

What the regulatory wave taught the industry: Voluntary best practices did not work. Water utilities that ignored cybersecurity for decades are now facing mandatory requirements, AWIA risk assessments in the US, NIS2 compliance in Europe (with penalties up to 10M EUR or 2% of global turnover), and state-level mandates appearing across the country, starting with New York's first-in-nation water cybersecurity rules.

What's at Risk: Water Utility OT Systems

Every one of the incidents above targeted or could have impacted these systems:

The common thread across every vulnerability column: default credentials, no segmentation, no encryption, no logging. These are not advanced security gaps. They are basic ones, and they persist because water utilities have tiny budgets, minimal IT staff, and distributed infrastructure that makes traditional security approaches impractical.

Applying the Lessons: Network-Level Security for Water Utilities

Each incident points to a specific defensive measure. Zero-trust network appliances deployed at treatment plants and remote sites, the Trout Access Gate is one example, create an encrypted overlay across the entire utility network:

1. Segment treatment from distribution from corporate (lesson from South Staffordshire), Separate the SCADA server network from the HMI workstations from the historian from corporate IT. An IT ransomware incident stays in IT.

2. Isolate every remote site (lesson from Volt Typhoon), Each pumping station gets its own encrypted tunnel to the SCADA server. A compromised RTU at one pump station cannot reach any other pump station or the treatment plant control network.

3. Kill shared credentials for remote access (lesson from Oldsmar), Replace TeamViewer with identity-based, MFA-protected, session-recorded remote access. Every connection to a SCADA system is attributed to a specific person with a specific authorization.

4. Block direct internet exposure of OT devices (lesson from Aliquippa), No PLC, RTU, or HMI should be reachable from the internet. Overlay networking ensures that OT devices are only accessible through authenticated, encrypted paths.

5. Encrypt cellular and radio links (lesson from distributed infrastructure), Overlay encryption on WAN connections between remote sites and the treatment plant. Even if an attacker intercepts cellular traffic, the SCADA commands are encrypted and authenticated. If a remote site loses its WAN connection, the local appliance continues to enforce access policy.

What a Secured Water Utility Looks Like

After deploying network-level security, a water utility can demonstrate:

• No default credentials on any network path: Every connection requires authentication
• Full session logging: Every remote access session to every SCADA system is recorded and auditable
• Network segmentation: Treatment, distribution, and corporate networks are isolated
• Encrypted communications: All SCADA traffic between sites travels through encrypted overlays
• Incident detection: Unauthorized connection attempts are detected and alerted
• Compliance documentation: Automated evidence generation for AWIA, NIS2, and state-level requirements

The investment required is a fraction of what a ransomware incident would cost, and incomparably less than a public health incident caused by compromised chemical dosing. Power grid operators face a similar distributed infrastructure challenge; our analysis of substation security and zero trust for distributed energy OT covers how overlay networking solves the same problem at scale. For water utilities, network-level security is not an IT project. It is a public safety measure.

The pattern that works for a small system

Put an on-premise access gateway in front of the control network:

• The operator or integrator connects to the gateway, not to the network.
• The gateway authenticates them against your identity provider, or acts as the identity and MFA anchor itself if you do not have one, and grants access to only the specific system, for a limited time window.
• Every session is recorded, so an incident is a lookup, not a forensic exercise.
• The PLC and HMI install nothing and never change.

The gateway sits in the remote-access path, not the control loop. If it goes offline, on-site operators still run the plant directly from the HMI; only remote access pauses until it is back. That is the honest trade a small system can live with.

This is Zero Trust for the plant, sized for a utility that does not have an OT security team.

Compliance and funding

State drinking-water and wastewater programs increasingly review remote access during surveys, and AWIA risk and resilience assessments call out electronic control systems. Controlled, recorded remote access is a clean way to satisfy that. For New York systems, this work is eligible under the EFC SECURE grant, and it aligns with the NY water cybersecurity rules.

The full picture, the threats that actually reach SCADA, the six controls and the standards, is in SCADA security: the complete guide. It is also available as a 38-page PDF.