10 Cybersecurity Risks Facing Water Utilities

Water utilities are essential to public health, public safety, economic stability, and community confidence. Unlike many traditional information technology environments, water and wastewater systems rely on operational technology, SCADA systems, programmable logic controllers, remote telemetry, treatment processes, pumping systems, chemical feed systems, and field devices that directly affect physical operations.

Because of this, cybersecurity in the water sector is not only about protecting data. It is also about protecting water quality, service continuity, worker safety, regulatory compliance, and public trust.

The National Institute of Standards and Technology Cybersecurity Framework 2.0 provides a practical structure for managing cybersecurity risk through the functions of Govern, Identify, Protect, Detect, Respond, and Recover. NIST SP 800-82 Rev. 3 provides additional guidance for securing operational technology environments while recognizing the unique reliability, safety, and availability requirements of OT systems. The American Water Works Association also provides water-sector-specific cybersecurity guidance and a risk management tool to help utilities evaluate and prioritize cybersecurity controls.

Below are 10 cybersecurity risks facing water utilities.

1. Internet-Exposed SCADA and Remote Access Systems

One of the most serious risks facing water utilities is unnecessary exposure of operational technology systems to the internet. SCADA servers, human-machine interfaces, remote access tools, VPN portals, firewall management interfaces, and remote telemetry systems may become attractive targets if they are reachable from outside the organization.

For many utilities, remote access is operationally necessary. Vendors, engineers, operators, and maintenance personnel may need to support systems after hours or from remote locations. However, remote access should be tightly controlled, monitored, and limited to authorized users.

Recommended practices include using secure VPN access, enforcing multi-factor authentication, removing unnecessary internet-facing services, restricting vendor access, logging remote sessions, and regularly reviewing firewall rules.

2. Weak Passwords and Lack of Multi-Factor Authentication

Weak, reused, shared, or default passwords remain a major cybersecurity risk. In some OT environments, accounts may be shared among operators or vendors for convenience. In other cases, legacy systems may still use default credentials or passwords that have not been changed in years.

A compromised password can allow an attacker to access email, business systems, remote access portals, engineering workstations, or even systems connected to SCADA environments. Multi-factor authentication provides an additional layer of protection by requiring more than just a password.

Water utilities should prioritize MFA for remote access, administrator accounts, cloud services, email, VPN access, and any system that could affect operations.

3. Poor IT and OT Network Segmentation

Many water utilities operate both business networks and operational networks. The business network may include email, billing, finance, file sharing, and internet access. The OT network may include SCADA servers, PLCs, HMIs, historians, telemetry systems, pump stations, and treatment plant control systems.

When these networks are not properly segmented, a compromise in the business environment can spread into the operational environment. For example, ransomware that begins with a phishing email could move laterally into systems that support water operations.

Good segmentation includes firewalls between IT and OT networks, controlled access paths, restricted communication between zones, monitoring of traffic crossing trust boundaries, and documented network diagrams. NIST SP 800-82 emphasizes the importance of understanding OT architectures and applying safeguards that account for safety, reliability, and availability.

4. Legacy Systems and Unsupported Software

Water utilities often depend on systems that were installed years ago and are still operational because they remain reliable. However, legacy systems may run outdated operating systems, unsupported software, old firmware, or applications that cannot be easily patched.

Replacing these systems may be expensive or operationally disruptive. However, leaving them unmanaged creates risk. A practical approach is to identify legacy assets, document their purpose, restrict access, isolate them where possible, monitor them closely, and plan for phased upgrades.

Cybersecurity does not always require immediate replacement of every older device. It does require knowing where those devices are, what they do, who can access them, and how they are protected.

5. Incomplete Asset Inventory

A utility cannot effectively protect what it cannot see. Incomplete asset inventory is a common risk in water environments, especially where pump stations, remote sites, telemetry equipment, cellular routers, radios, PLCs, and vendor-managed systems are spread across multiple locations.

An accurate inventory should include servers, workstations, network equipment, PLCs, HMIs, remote terminal units, firewalls, switches, radios, cellular modems, cloud services, software versions, firmware versions, vendor connections, and critical data flows.

The NIST Cybersecurity Framework places strong emphasis on identifying assets, business context, dependencies, and risks. For water utilities, asset inventory is the foundation for vulnerability management, incident response, network segmentation, and recovery planning.

6. Ransomware Affecting Business or Operational Systems

Ransomware remains a major threat to utilities. Even if SCADA systems are not directly encrypted, ransomware can disrupt billing, work orders, email, customer service, reporting, engineering files, laboratory records, maintenance systems, and access to operational documentation.

In more serious cases, ransomware can affect systems that support plant operations or remote monitoring. This can force utilities to operate manually, delay response to alarms, or reduce visibility into field conditions.

Utilities should maintain offline or immutable backups, test restoration procedures, restrict administrative privileges, monitor for unusual behavior, and ensure incident response plans include both IT and OT considerations.

7. Vendor and Third-Party Access Risk

Water utilities often rely on vendors, integrators, engineers, managed service providers, chemical suppliers, SCADA contractors, instrumentation specialists, and equipment manufacturers. These partners may require remote or on-site access to critical systems.

Third-party access creates risk when it is not properly governed. Problems can include shared accounts, unmanaged laptops, always-on VPN tunnels, undocumented remote tools, lack of MFA, and unclear responsibility during incidents.

Utilities should document all vendor access, require approval for remote sessions, enforce MFA, limit access to only what is needed, monitor vendor activity, and remove access when it is no longer required.

8. Limited Monitoring and Detection

Many utilities invest in firewalls, antivirus, and backups but have limited visibility into whether something suspicious is happening across their network. Without monitoring, a utility may not know when a VPN account is abused, a firewall rule is changed, a workstation connects to an unusual destination, or an engineering workstation communicates unexpectedly with a controller.

Detection is one of the core functions of the NIST Cybersecurity Framework. For water utilities, monitoring should include firewalls, VPN activity, servers, workstations, domain controllers, cloud services, and critical OT network traffic where appropriate.

The goal is not to overwhelm utility staff with alerts. The goal is to identify meaningful activity that could affect operations, safety, or service continuity.

9. Insufficient Incident Response Planning

A cybersecurity incident can quickly become an operational, legal, regulatory, and public communications issue. If a utility does not have a clear incident response plan, staff may lose valuable time deciding who to call, what systems to isolate, how to preserve evidence, how to communicate with leadership, and how to continue operations.

An incident response plan should define roles, escalation paths, contact lists, vendor contacts, law enforcement or government coordination, backup procedures, manual operations procedures, and executive communication. It should also be tested through tabletop exercises.

For water utilities, incident response planning should include scenarios such as ransomware, unauthorized remote access, loss of SCADA visibility, suspicious PLC communication, compromised vendor credentials, and outage of business systems.

10. Weak Governance and Cybersecurity Ownership

Cybersecurity cannot be treated only as an IT issue. In water utilities, cybersecurity affects operations, engineering, safety, compliance, finance, procurement, customer service, and executive leadership.

The Govern function in NIST CSF 2.0 highlights the importance of cybersecurity risk management strategy, policy, oversight, roles, and accountability. AWWA’s water-sector guidance also supports a risk-based approach that helps utilities identify appropriate controls based on their specific systems and threat environment.

Utility leaders should ensure cybersecurity responsibilities are clearly assigned, risks are communicated to decision-makers, and investments are prioritized based on operational impact.

Conclusion

Water utilities do not need to become large cybersecurity organizations overnight. However, they do need a practical, risk-based cybersecurity program that reflects the realities of water operations.

The most effective starting points are often straightforward:

Identify critical assets.

Secure remote access.

Use multi-factor authentication.

Segment IT and OT networks.

Monitor firewalls, VPNs, servers, and critical systems.

Maintain tested backups.

Develop and exercise an incident response plan.

Review cybersecurity risks with leadership.

By aligning with NIST and AWWA guidance, water utilities can move from reactive cybersecurity to a more resilient and defensible approach that protects operations, customers, and the communities they serve.

References / Works Cited

National Institute of Standards and Technology. The NIST Cybersecurity Framework 2.0. 2024.

National Institute of Standards and Technology. NIST Special Publication 800-82 Revision 3, Guide to Operational Technology Security. 2023.

American Water Works Association. Cybersecurity Guidance and Water Sector Cybersecurity Risk Management Tool.

American Water Works Association. Water Sector Cybersecurity Risk Management Guidance.

Timehri Networks, LLC helps utilities, municipalities, industrial facilities, and critical infrastructure organizations strengthen cybersecurity, OT security, SCADA security, and operational resilience.