Securing Internet-Exposed OT at Small Critical Infrastructure Sites

The Problem: Why This Matters Now

Your local water treatment plant likely has a programmable logic controller (PLC) sitting on the public internet right now. So does the community-owned generator two towns over. These aren't theoretical vulnerabilities. The Cybersecurity and Infrastructure Security Agency (CISA) observed malicious activity targeting more than 100 internet-exposed water-sector systems in July alone.

The FBI and Environmental Protection Agency confirmed attacks on water and wastewater utilities in at least seven states, targeting internet-facing Rockwell Automation MicroLogix 1100 and 1400 PLCs. Attackers changed IP addresses and passwords, causing operators to lose monitoring and control. Some attacks led to loss of water pressure and flooding.

A separate incident forced a small British electricity generator offline for four days. While these sites may seem inconsequential individually, they collectively create opportunities for widespread disruption, especially when dependencies exist among power, water, manufacturing, and transportation providers.

Small municipal water systems, rural cooperatives, and community-owned facilities face a structural disadvantage. They've digitized for efficiency, allowing remote monitoring, but they lack the security programs and budgets protecting larger utilities. Equipment designed decades ago, when manufacturers never contemplated internet-based attacks, now sits exposed because there's no formal process to prevent an engineer from connecting it.

What You Need Before Starting

Before securing operational technology, ensure you have visibility and authority:

Asset Inventory: Document every PLC, cellular modem, remote terminal unit, and SCADA component connected to your network. Include make, model, firmware version, and current network configuration. If you're unsure what's exposed, start with external scanning tools like Shodan or Censys to see what attackers already see.

Known-Good Configuration Baselines: Archive verified copies of PLC programs and ladder logic. You'll need these to detect unauthorized changes and restore systems after an incident.

Manual Operation Procedures: Document step-by-step instructions for operating critical equipment without network connectivity. Test these procedures with operators who work different shifts.

Management Authorization: Get written approval to disconnect or reconfigure internet-facing systems. Small utilities often resist changes that might affect remote monitoring convenience, so document the risk and regulatory exposure.

Basic Network Equipment: You'll need a firewall or VPN gateway capable of handling remote access. For cellular modems, prepare to configure access-control lists or replace units that don't support authentication.

Step-by-Step Implementation

Phase 1: Remove Direct Internet Exposure

Start with your most critical systems, those controlling water pressure, power distribution, or chemical dosing.

For each PLC or RTU currently accessible from the public internet:

• Place it behind a firewall or VPN gateway.
• Configure the firewall to deny all inbound traffic by default.
• Create explicit allow rules only for authorized source IP addresses.
• If using a VPN, require certificate-based authentication, not just passwords.

For cellular modems providing remote access:

• Enable authentication if the device supports it.
• Configure access-control lists to permit only specific IP ranges.
• If the modem lacks security features, replace it with a unit that supports VPN or place it behind a separate security gateway.
• Disable any web-based management interfaces exposed to the cellular network.

Phase 2: Harden Remaining Access Points

For systems that genuinely require remote monitoring:

• Replace all default passwords with unique credentials at least 16 characters long.
• Store these credentials in a password manager, not in a shared spreadsheet.
• Enable logging on all remote access points and forward logs to a central location.
• Configure physical or software key switches to the run position to prevent unauthorized program changes.

Phase 3: Implement Monitoring and Validation

Set up basic detection for unauthorized changes:

• Schedule weekly comparisons of running PLC programs against your known-good baselines.
• Configure alerts for authentication failures on remote access gateways.
• Monitor for unexpected changes to IP addresses or network configurations.
• Review logs monthly for access from unexpected source addresses.

Phase 4: Prepare for Manual Operation

For each critical system:

• Post printed manual operation procedures at the equipment location.
• Include emergency contact information and escalation paths.
• Conduct quarterly drills where operators switch to manual mode and verify they can maintain safe operation.
• Document any equipment that cannot be operated manually and develop contingency plans.

Validation: How to Verify It Works

External Verification: Run an external port scan from an internet-connected system outside your network. You should see no open ports on PLC IP addresses. If you're using a VPN gateway, verify that it requires authentication before allowing any access.

Access Control Testing: Attempt to connect to each PLC from an unauthorized IP address. The connection should be blocked at the firewall. Document this test and the date performed.

Configuration Integrity: Compare current PLC programs with your archived baselines. Any differences should be documented changes made through your change management process. At least one victim facility found altered PLC project files and discrepancies in the ladder logic controlling equipment, your baseline comparison should catch this.

Manual Operation Drill: Disconnect network access to a non-critical system and verify operators can switch to manual mode within the time window your procedures specify. If they can't, revise your procedures until they work in practice.

Maintenance and Ongoing Tasks

Monthly:

• Review remote access logs for failed authentication attempts or access from unexpected locations.
• Verify firewall rules haven't been inadvertently modified.
• Check for firmware updates to PLCs, RTUs, and network equipment.

Quarterly:

• Compare running PLC programs against known-good baselines.
• Conduct manual operation drills with different operators.
• Review and update the asset inventory as equipment changes.

Annually:

• Reassess which systems require remote access and whether alternatives exist.
• Update manual operation procedures based on drill results.
• Test backup and restoration of PLC programs.

After Any Network Change:

• Re-verify that PLCs remain unexposed to the internet.
• Update firewall documentation.
• Confirm monitoring and alerting still function.

You're not building a sophisticated OT security program here. You're implementing basic controls that prevent opportunistic attacks exploiting exposed industrial equipment. As one practitioner put it: "We don't care; it could be Martians, it could be Iranians, it could be Americans. We need to be better, and if someone's proving they have these capabilities, then we need to take that warning."

The attackers targeting these systems aren't using advanced persistent threat techniques. They're scanning for exposed PLCs and exploiting the absence of basic protections. Close that gap before they find yours.