How Water and Wastewater Utilities Can Identify Internet-Exposed OT Assets

By Franklyn C. Adams,
Timehri Networks

A water or wastewater utility may have a network diagram, an asset inventory, firewall documentation, and a list of approved remote-access connections.

But there is another important question:

What can someone outside the utility actually see?

The answer may not always match what appears in the utility’s internal documentation.

A utility may know about its primary VPN gateway and public-facing services but overlook a cellular modem at a remote lift station, a vendor-installed gateway, an old firewall rule, an HMI web interface, or another externally accessible service.

For operational technology environments, understanding the difference between the expected external footprint and the observed external footprint is an important part of managing cyber risk.

CISA recommends that organizations begin internet exposure reduction by identifying which assets are accessible from the internet, determining whether that exposure is necessary, and mitigating the risk associated with assets that must remain accessible. CISA

CISA Internet Exposure Reduction Guidance

So how can a water or wastewater utility determine what OT-related systems are actually visible from the public internet?

It starts by looking at the environment from both directions.

Start With What You Think You Have

Before looking outward, establish an internal baseline.

The utility should maintain an inventory of equipment that communicates with or provides access to the operational environment. Depending on the facility, this may include:

SCADA servers
Human Machine Interfaces (HMIs)
Programmable Logic Controllers (PLCs)
Remote Terminal Units (RTUs)
Engineering workstations
Firewalls and routers
VPN appliances
Cellular routers and modems
Industrial gateways
Radio and telemetry equipment
Remote-access servers
Vendor-installed appliances
Security cameras connected to operational networks
Cloud-connected monitoring equipment

For each asset, the utility should understand its location, function, owner, IP address, communications method, and whether external connectivity is required.

EPA’s guidance recognizes PLCs, RTUs, HMIs and SCADA systems as common forms of OT used by water and wastewater systems and emphasizes the importance of understanding whether these systems are network-connected or remotely accessible. US EPA

EPA: Assessing Whether a Water and Wastewater System Has Operational Technology

This inventory establishes what the organization expects to find.

The next step is determining whether the outside world sees the same thing.

Identify the Utility’s Public Footprint

A utility should know the public IP addresses, domains, and internet-facing services associated with its operations.

That may include infrastructure supporting:

Treatment plants
Administrative facilities
Remote facilities
VPN gateways
Firewalls
Cellular communications
Cloud services
Vendor-managed systems

For each externally accessible service, the utility should be able to answer:

What is it?

Who owns it?

Why does it need to be externally accessible?

What does it connect to?

Who is responsible for securing it?

An external service without clear answers to these questions deserves further investigation.

Review the Firewall From the Outside In

Network diagrams help explain how an environment was designed.

Firewall configurations can help reveal how that environment is actually accessible.

Utilities should periodically review internet-facing firewalls for:

Inbound access rules
Network Address Translation (NAT) rules
Port forwarding
VPN configurations
Remote administration interfaces
Vendor-specific rules
Temporary troubleshooting rules
Legacy configurations

A rule may have been created years ago for a legitimate operational requirement and remained as systems and operational needs changed.

That does not necessarily indicate poor engineering. OT environments often evolve over many years through multiple projects, integrators, equipment generations, and operational requirements.

The purpose of the review is to establish whether each externally accessible service still has a documented operational need.

EPA recommends eliminating unnecessary exposed services on public-facing assets and regularly reviewing those services. It also recommends eliminating OT connections to the public internet unless they are explicitly required for operations. EPA NERL

EPA Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems

Look Beyond the Treatment Plant

One of the easiest ways to develop an incomplete picture is to concentrate exclusively on the utility’s primary facility.

Water and wastewater systems are geographically distributed environments.

A utility may operate:

Wells
Tanks
Reservoirs
Booster stations
Pump stations
Lift stations
Remote treatment facilities
Chemical monitoring stations
Distribution monitoring equipment

These sites may communicate through fiber, licensed radio, cellular networks, private carrier services, or public internet connections.

EPA specifically identifies cellular modems connecting remote assets such as tanks, lift stations, and wells as an example of internet connectivity that can be overlooked when assessing OT exposure. US EPA

A firewall assessment performed only at the main treatment facility therefore may not identify the utility’s complete external footprint.

Cellular Does Not Automatically Mean Internet-Exposed

There is an important distinction.

A cellular modem does not necessarily mean a PLC or RTU is directly reachable from the public internet.

Cellular services can be configured using private carrier networks and other architectures that restrict public accessibility. EPA recommends placing cellular modems used for OT communications on telecommunications providers’ private networks whenever possible. US EPA

The utility should therefore verify rather than assume.

For each cellular-connected OT location, determine:

Whether the connection uses public or private addressing
Whether unsolicited inbound connections are permitted
What remote-management services are enabled
Whether the cellular router itself is remotely accessible
Who manages the cellular service
What equipment exists behind the connection
Whether the connection appears in the OT asset inventory

This exercise can reveal remote pathways that may not be apparent when reviewing the central SCADA network.

Now Look at the Utility From the Internet

This is where the exercise becomes particularly valuable.

The utility has established what it believes should be publicly accessible.

Now it can independently determine what is actually visible.

CISA recommends using external discovery and vulnerability-scanning resources to identify publicly exposed systems and gain visibility into an organization’s online footprint. CISA

Utilities can use appropriate defensive discovery services to investigate their own authorized public IP addresses, domains, and infrastructure.

Depending on the service and environment, external discovery may identify:

VPN gateways
Firewall interfaces
Web-management portals
Remote-access services
Industrial gateways
HMIs
Cameras
Network equipment
Unexpected externally accessible services

The objective at this stage is not simply vulnerability discovery.

The first objective is asset discovery.

Why External Discovery Matters

EPA and CISA have demonstrated why this perspective matters.

In joint guidance concerning internet-exposed HMIs, the agencies reported identifying exposed HMIs at water and wastewater systems using publicly available web-based search platforms. Their recommendations include inventorying internet-exposed devices and disconnecting accessible and unprotected HMIs from the public-facing internet where possible. US EPA

EPA and CISA: Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems

That leads to an important principle:

If defenders can discover an OT-related asset from the public internet, organizations should assume that potential adversaries may be able to discover it as well.

The question then becomes whether that exposure is intentional, necessary, documented, and adequately protected.

Compare the Outside View With the Inside Inventory

This may be the most important part of the exercise.

Do not evaluate external discovery results in isolation.

Compare them with the utility’s internal inventory.

Imagine the utility’s documentation identifies:

6 approved internet-facing systems.

External discovery identifies: 8.

The cybersecurity and OT teams now have two important questions:

What are systems seven and eight?

Why weren’t they in our inventory?

The explanation may be relatively straightforward.

One may be a recently installed vendor appliance.

Another may belong to a different utility department.

But the discrepancy could also reveal an undocumented remote-access device, legacy service, forgotten test system, or incorrectly configured equipment.

Conversely, the inventory might list a public-facing system that external discovery no longer detects.

That deserves investigation as well.

The goal is reconciliation:

Expected External Footprint = Observed External Footprint

When those two views do not match, investigate the difference.

Take Advantage of CISA’s Vulnerability Scanning

Internet discovery provides one source of visibility.

Authorized external vulnerability scanning provides another.

CISA’s Cyber Hygiene Vulnerability Scanning service continuously monitors registered public, static IPv4 assets and provides organizations with information about host and vulnerability status. CISA states that participants receive weekly reports as well as alerts for urgent findings such as potentially risky services and known exploited vulnerabilities. CISA

CISA Cyber Hygiene Services

CISA has also published guidance specifically encouraging drinking water and wastewater utilities to use its no-cost vulnerability-scanning service. According to CISA, the service can help identify internet-accessible assets, vulnerabilities affecting those assets, known exploited vulnerabilities, and exposed services commonly associated with initial access. CISA

CISA: Free Cyber Vulnerability Scanning for Water Utilities

For a smaller utility with limited cybersecurity resources, this can provide an additional source of external visibility without immediately requiring the purchase of another commercial cybersecurity platform.

Don’t Forget the People Who Know the System

Technical tools are important, but OT asset discovery should not be performed exclusively from a computer.

Operators, instrumentation technicians, electricians, engineers, IT personnel, system integrators, and equipment vendors may each know something about the environment that never made its way into formal documentation.

Walk the facilities.

Look inside communications cabinets and appropriate control enclosures.

Ask questions such as:

How does the vendor connect to this equipment?

Is there a cellular modem associated with this system?

How do operators access this site after hours?

Can the integrator troubleshoot this equipment remotely?

Who manages this router or gateway?

Was temporary remote access ever established here?

What happens if this communications link is unavailable?

A conversation with the technician responsible for a remote pumping station may reveal a communications pathway that does not appear on the network diagram.

Effective OT asset discovery combines technical evidence with operational knowledge.

Build an Internet Exposure Register

The discovery process should produce something that can be maintained.

Consider creating an Internet Exposure Register.

At minimum, record information such as:

Asset	Location	External Service	Owner	Purpose	Approved	Last Reviewed
VPN Gateway	Treatment Plant	VPN	IT/OT	Remote staff access	Yes	Quarterly
Cellular Gateway	Lift Station 4	Carrier network	OT	SCADA telemetry	Yes	Quarterly
Vendor Appliance	Pump Station	Remote support	Vendor/OT	Equipment support	Review	Quarterly
HMI	Treatment Plant	None	Operations	Process control	N/A	Quarterly

For internet-accessible assets, additional fields may include the public IP address, hostname, authentication method, responsible vendor, applicable firewall rule, date discovered, remediation status, and documented business justification.

The exact format matters less than the management principle:

Every externally accessible OT-related system should have an owner and a reason for being there.

Treat Exposure Discovery as a Lifecycle

An external attack surface is not static.

A utility can complete a thorough assessment today and have a different environment six months later.

A contractor installs a cellular router.

A new SCADA component is commissioned.

A vendor establishes remote support.

A firewall is replaced.

A temporary troubleshooting connection remains active.

A cloud monitoring service is introduced.

CISA’s Internet Exposure Reduction Guidance recommends routine assessment because externally accessible environments change over time. CISA

The process should also be revisited after significant network, firewall, communications, vendor-access, or SCADA changes.

What About “Air-Gapped” Systems?

Utilities should also be careful about assuming that an OT environment is completely isolated.

EPA notes that even an OT system considered air-gapped may still be vulnerable to cyber incidents. EPA NERL

Before describing a SCADA network as isolated, verify the architecture.

Consider cellular communications, dual-homed systems, vendor equipment, temporary connections, wireless links, removable media workflows, remote-management equipment, and connections between IT and OT.

In OT cybersecurity:

Verified isolation is more meaningful than assumed isolation.

What Should a Utility Do With What It Finds?

Discovery should not automatically become disconnection.

OT systems control physical processes. Removing connectivity without understanding its operational dependencies could create unintended consequences.

Instead, evaluate each finding with operations, engineering, IT, cybersecurity personnel, and system integrators as appropriate.

For each externally accessible OT-related asset, determine:

Is this connection operationally necessary?

If not, evaluate removing or restricting the exposure through the organization’s established change-management process.

If the connection is necessary, are appropriate protections in place?

EPA recommends eliminating OT connections to the public internet unless explicitly required for operations. When operational requirements make connectivity necessary, EPA identifies compensating controls including MFA, firewalls, and centralized logging. US EPA

Three Questions Utility Leadership Should Be Able to Answer

Ultimately, this exercise should allow leadership to confidently answer:

What can the internet see?

Why can it see it?

Who is responsible for protecting it?

If the organization cannot answer all three, the next step is not necessarily purchasing another cybersecurity product.

The next step may simply be gaining better visibility.

Final Thought

An asset inventory tells a utility what it believes it operates.

An external assessment helps reveal what the rest of the world can see.

Both views are necessary.

For water and wastewater utilities, that means understanding the organization’s public-facing infrastructure, reviewing firewall and NAT configurations, accounting for cellular and vendor connectivity, using authorized external discovery and vulnerability-scanning resources, talking with the people who maintain the systems, and reconciling those findings against the internal OT inventory.

The objective is not to eliminate connectivity that operations legitimately require.

It is to eliminate unknown exposure.

An internet-facing asset that the utility does not know about cannot be effectively governed, monitored, or protected.

Know what you operate. Know what is exposed. Know why it is exposed.

That is where external OT attack-surface management begins.

About Timehri Networks

Timehri Networks focuses on Operational Technology (OT), Industrial Control Systems (ICS), SCADA, and critical-infrastructure cybersecurity. We help utilities and industrial organizations identify cybersecurity risks and strengthen operational resilience through practical, risk-based security strategies.

Protecting Critical Infrastructure Through Practical Cybersecurity.

Visit Timehri Networks

Sources & Further Reading

These are the links I recommend displaying at the bottom of the published article: