[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2e5SqaXrUMlqlC698yGK1fk5K1WPWmCM8Zx61WO7PKY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"2993d947-2f49-4ab2-95a7-3c5f078817c2","exposed-plcs-in-water-systems-under-active-attack","b3be43b6-9a53-4669-8996-0466503ebebe","Exposed PLCs in Water Systems Under Active Attack","Threat actors are actively targeting internet-exposed Programmable Logic Controllers (PLCs) in the Water and Wastewater Systems sector, exploiting default or weak credentials to lock out legitimate operators and manipulate device configurations. The root problem is a combination of poor network segmentation — leaving OT devices directly accessible from the internet — and inadequate access control policies such as unchanged default passwords. These attacks have real-world physical consequences, including boil water advisories that endanger public health. Critical infrastructure operators often underestimate the cyber risk to OT environments, mistakenly assuming air-gapping or obscurity provides sufficient protection. This incident underscores that OT security must be treated with the same rigor as IT security, especially as legacy industrial systems increasingly gain internet connectivity.","**Immediate Actions:**\n- Disconnect all PLCs and OT devices from direct internet exposure and place them behind firewalls or demilitarized zones.\n- Audit and immediately change all default or weak passwords on PLCs, HMIs, and related OT devices.\n- Enforce multi-factor authentication (MFA) for any remote access to OT environments.\n\n**Long-Term Improvements:**\n- Implement network segmentation to isolate OT\u002FICS networks from corporate IT networks and the public internet.\n- Replace direct internet access with secure VPNs or encrypted industrial gateways for all authorized remote access.\n- Maintain a current asset inventory of all OT\u002FICS devices, including firmware versions and network-facing exposure.\n\n**Detection & Monitoring Measures:**\n- Deploy OT-aware intrusion detection systems (IDS) to alert on unauthorized configuration changes or login attempts on PLCs.\n- Enable centralized logging of all authentication events and configuration changes across OT devices.\n- Establish and regularly test an incident response plan specifically tailored to OT\u002FICS disruptions.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-82 Rev. 3 – Guide to OT Security","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SC-7 – Boundary Protection","NIST IR-4 – Incident Handling","ICS-CERT \u002F CISA Recommended Practices for ICS Security","NERC CIP-005 – Electronic Security Perimeters","ISA\u002FIEC 62443-3-3 – System Security Requirements and Security Levels",{},"published","2026-07-30T22:21:08.360178+00:00","2026-07-30T22:21:08.274+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F07\u002F30\u002Fcisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs","cisa-urges-water-and-wastewater-systems-sector-to-protect-ot-against-activity-ta-2f554f","CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[53,57,61],{"slug":54,"name":55,"problem":56},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":58,"name":59,"problem":60},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":62,"name":63,"problem":64},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]