On LinkedIn
Unplug, go manual, stay safe: the most comforting bad idea in OT security.
That was the expert advice in the water utility story doing the rounds.
Not being able to reach the plant yourself has never stopped anyone else. An attacker who wants that pump house will happily drive the hour. I have lost count of the customers who told me they were air-gapped, right up until we found the vendor’s tunnel. Still up, still shared, still on the 2017 commissioning credentials.
A Georgia utility lost water pressure this summer. Low pressure pulls untreated groundwater back into the pipes. Nobody had to poison anything. They just took the pressure away. Pen and paper does not put it back.
So here is the question nobody gets asked. If your monitoring only needs to read a value off that PLC, the box that runs the pump, why can it change one? And if your vendor maintains their own PLC, why can they reach the other three?
Read is not write. Monitor is not operate. Your supplier is not everyone.
That is Zero Trust, and a pump deserves it more than a database does. One PLC, one direction, one party. Deny the rest.
Paper is not a control. It is a coping mechanism.
This week: list every connection into your OT from outside. One question per line: can it write, or only read? If nobody can answer inside an hour, you have your answer.
Tell me what you find.
The story: Gizmodo on why water plants are still online, with Betsy Soehren Jones of the Critical Infrastructure Security Consortium.
The underlying material is CISA’s own: a July 2026 alert on threat actors targeting PLCs, and an April 2026 one naming Iran. Minnesota alone logged around three dozen attacks on municipal water systems this summer.
For the doers: start at the firewall, not the PLC. Pull every rule that allows inbound to your OT segment and read the destination. One vendor, one device, one protocol, one direction. Everything else is a finding.
Yes, that is boring work. So is a boil-water notice.