How water utilities can make PLCs, HMIs, and SCADA systems harder for attackers to discover and reach

Quick answer

Water utilities can reduce OT cyber risk by identifying internet-facing assets, removing unnecessary exposure, requiring authentication before connection, replacing reusable credentials, microsegmenting critical devices, continuously monitoring access paths, and preparing operators for manual operation.

Network cloaking adds an important preventive layer: unauthorized users and scanning tools cannot attack protected assets they cannot discover.

Schedule a 20-Minute BlastShield Demo

What happened in the Minnesota water utility cyberattacks?

In July 2026, a coordinated cyberattack targeted more than 30 Minnesota water utilities. The incidents disrupted remote monitoring and control, forcing some operators to rely on manual procedures.

The attacks exposed four common OT security weaknesses:

• Internet-facing industrial systems
• Vulnerable remote-access pathways
• Legacy infrastructure
• Insufficient network segmentation

The disturbing part was not the sophistication of the attack. It was the lack of sophistication required.

As UTSI CEO Shaun Six explained:

“It’s not a super-sophisticated attack. There was no supercomputer cracking cryptography.”

Attackers did not necessarily need a zero-day vulnerability or custom malware. They could use standard industrial software to connect to discoverable equipment, sometimes through default or reusable credentials.

Why can an OT attack occur without malware or a CVE?

An OT attack may not require malware or a known software vulnerability when a controller is exposed to the internet and accepts ordinary remote connections.

If an attacker obtains valid credentials—or tries an unchanged default password—the resulting activity may appear to be a normal login. Because no exploit is used, there may be no CVE to patch and no malicious file to detect.

UTSI’s OT cybersecurity practice lead described the attack path:

“There was no exploit. They didn’t use malware. They used the same software that we use today to program our equipment.”

This is why patching, firewalls, VPNs, and monitoring alone may leave critical gaps. Those controls can be valuable, but they may not prevent unauthorized users from discovering that an asset exists.

‍

Watch the complete webinar

After Minnesota: A 30-Minute Architecture Fix for Water Utility OT Networks

BlastWave CEO Tom Sego and UTSI CEO Shaun Six explain how attackers reach operational environments and how utilities can reduce exposure without replacing the PLCs, HMIs, SCADA systems, servers, and other infrastructure already in service.

‍

How to reduce cyber risk in a water utility OT network

Water utilities can use the following process to reduce discoverability, strengthen remote access, restrict lateral movement, and improve operational resilience.

Step 1: Identify exposed OT assets

Create an inventory of systems that can be reached from the public internet or through remote-access services.

Look for:

• PLCs and RTUs
• HMIs
• SCADA servers
• Engineering workstations
• VPNs and remote desktop services
• Vendor connections
• Dual-homed computers
• Cellular modems
• Unknown or temporary access paths

External scans, firewall logs, firewall rules, and network assessments can help find exposed systems. Results should be interpreted by someone who understands normal OT operations.

Step 2: Remove unnecessary internet exposure

Disconnect services and devices that do not need to be publicly reachable.

Where remote connectivity is operationally necessary, place modern access controls around the legacy system. Do not rely on the controller’s native login page or default security capabilities as the primary line of defense.

Step 3: Require authentication before connection

Traditional networks often allow a device or service to become visible before the user authenticates.

A prevention-first architecture reverses that sequence:

1. Verify the identity of the user or device.
2. Confirm that the identity is authorized.
3. Establish an encrypted connection.
4. Reveal only the approved resource.

Unauthenticated traffic should receive no useful response.

BlastWave solutions architect Joe Baxter explained the result:

“You don’t just have a really strong lock on the door. You don’t just have a security camera on the door. The door doesn’t exist.”

Step 4: Eliminate reusable credentials from the attack path

Default and reusable passwords can be guessed, stolen, shared, or socially engineered.

Use passwordless, identity-based access where possible. Authentication should occur before an individual can reach the protected PLC, HMI, server, or network segment.

As Baxter noted:

“When there’s no password to guess, it doesn’t matter if you have the default password. Try any of them. There’s nothing to apply that password against.”

Step 5: Microsegment critical devices

Do not assume that a trusted user or device needs access to the entire operational network.

Create policies that specify:

• Which users can reach each system
• Which devices may communicate
• Which protocols are permitted
• Which ports are necessary
• When third-party access is allowed
• Where a connection may go next

Microsegmentation limits lateral movement. If one endpoint is compromised, the attacker should not automatically gain a path to neighboring PLCs, HMIs, or engineering systems.

Step 6: Apply deny-by-default policies

Allow only communication that matches an approved policy. Deny everything else by default.

This reduces the attack surface and prevents unexpected communication instead of relying solely on alerts after the communication begins.

Step 7: Monitor the environment continuously

OT environments change as equipment, sensors, vendors, and engineering workstations are added or replaced.

Monitor for:

• New devices
• New external exposure
• Unapproved remote access
• Changes to firewall rules
• Policy exceptions
• Unexpected device communication
• Vendor access that remains active after work is complete

Organizations without dedicated security personnel can use an OT-experienced managed security service provider.

Step 8: Prepare for manual operation

Technical controls should be supported by a tested continuity plan.

Water utilities should document and practice:

• Manual operating procedures
• Incident-response procedures
• Business-continuity plans
• Escalation and communication protocols
• Tabletop exercises
• Recovery drills
• Operator training

“The cost to remediate is one side of it. The cost to operate is another.”
— Shaun Six, UTSI

Step 9: Explore available cybersecurity funding

Federal, state, local, and water-specific programs may help fund assessments, remediation, managed services, training, and continuity planning.

Funding availability and eligibility change, so utilities should verify current program requirements. An experienced OT integrator can help define the scope, estimate ongoing operating costs, and prepare a defensible grant request.

What is network cloaking?

Network cloaking is a security approach that prevents unauthorized users and scanning tools from discovering protected network assets.

A cloaked PLC, HMI, SCADA server, or remote-access service does not respond to unauthenticated connection attempts. The resource becomes reachable only after the user or device has been authenticated and authorized.

Network cloaking helps prevent:

• Internet reconnaissance
• Port scanning
• Direct attacks against exposed services
• Attempts to use default credentials
• Unauthorized session establishment
• Discovery of neighboring systems

It reduces the opportunity to attack instead of waiting to detect an attack already in progress.

How does BlastShield protect legacy OT environments?

BlastShield adds Zero Trust protections around existing OT and IT infrastructure as a software overlay.

Its primary controls include:

• Network cloaking: Conceals protected assets from unauthorized users and scanning tools.
• Passwordless Industrial MFA: Authenticates identity without exposing reusable passwords.
• Secure remote access: Gives employees, integrators, and vendors access only to approved resources.
• Software-defined microsegmentation: Restricts lateral communication between users, devices, and network segments.
• Deny-by-default enforcement: Permits only communication that matches policy.

Utilities can therefore strengthen the architecture around legacy equipment without first replacing every PLC, HMI, SCADA system, or server.

“You get the network you want with the network you have.”
— Tom Sego, BlastWave

Frequently asked questions

What caused the Minnesota water utility cyberattacks?

The incidents were associated with exposed industrial systems, weak remote-access pathways, legacy infrastructure, insufficient segmentation, and—in some cases discussed during the webinar—default credentials. The attack did not necessarily require custom malware or a new vulnerability.

Why are water utilities targeted by cyberattackers?

Water is essential to municipalities, healthcare, manufacturing, energy, data centers, and other critical services. Disrupting a water system can therefore create consequences beyond a single facility. Smaller utilities may also have limited security staff and older infrastructure, making them easier to target at scale.

Can a firewall protect an OT network?

A firewall can be an important control, but it may not be sufficient by itself. If remote access is permitted through the firewall, the exposed service may still be discoverable and reachable. Network cloaking, identity-based access, and microsegmentation can reduce risks the firewall alone does not eliminate.

Is an air gap enough to protect a SCADA system?

A genuine physical air gap can prevent remote access, but many modern OT environments require connections for employees, vendors, monitoring, and maintenance. Apparent air gaps may also be undermined by dual-homed workstations, cellular connections, or undocumented access paths.

What is the difference between network cloaking and monitoring?

Monitoring looks for suspicious behavior and generates alerts. Network cloaking prevents unauthorized users from discovering or connecting to a protected resource. Organizations generally need both prevention and monitoring, but cloaking can stop some attacks before an alert is necessary.

What is OT microsegmentation?

OT microsegmentation restricts communication between individual users, devices, applications, and network segments. A user or endpoint can reach only the resources explicitly allowed by policy, reducing the ability of an attacker or malware to move laterally.

Can BlastShield protect old PLCs and SCADA systems?

BlastShield is designed to add protection around existing infrastructure as a software overlay. This allows organizations to cloak, control access to, and microsegment legacy assets without requiring an immediate replacement of every protected system.

Does BlastShield require a complete network redesign?

No. BlastShield is intended to overlay the existing environment. The deployment scope and configuration depend on the utility’s architecture, but the goal is to add modern controls without a disruptive rip-and-replace project.

Can small and rural water utilities afford OT cybersecurity?

Some utilities may qualify for federal, state, local, or water-specific funding. Relevant programs may help pay for assessments, remediation, managed services, training, and continuity planning. Availability and eligibility must be confirmed for each project.

What should a water utility do first?

Start by identifying internet-facing assets and remote-access paths. Determine which systems are discoverable, which credentials protect them, who can connect, and where an authorized or compromised connection can move next.

See network cloaking in a live environment

In a personalized 20-minute demonstration, BlastWave will show you how to:

• Cloak critical OT assets
• Make a protected network disappear from a port scan
• Replace exposed remote access with identity-based access
• Prevent a compromised endpoint from reaching PLCs and HMIs
• Apply microsegmentation without replacing the underlying infrastructure

If attackers can’t see the target, they can’t begin the attack.

Schedule Your Live BlastShield Demo