Protecting Critical Infrastructure: A Cybersecurity Guide for Water & Utility Operators

In 2021, an attacker accessed the water treatment system in Oldsmar, Florida and attempted to change chemical levels. An operator noticed the on-screen cursor moving unexpectedly and intervened before harm occurred.

The lesson is not that every utility faces a movie-style intrusion. The lesson is that operational technology (OT) incidents can have physical consequences, and many environments have real constraints that make “standard IT security advice” hard to apply.

This guide is written for water and utility operators who need practical steps. It focuses on what changes in OT and SCADA environments and which controls reduce real risk without disrupting operations.

Why OT is different (and why that matters)

OT and industrial control systems often prioritize safety and availability over rapid change. That changes how you secure them. Patching schedules can be limited. Legacy systems can remain in service for decades. Vendor remote access is common. And IT and OT networks are increasingly connected for reporting, efficiency, and maintenance.

Those realities do not mean “you cannot secure OT.” They mean your program needs the right focus: visibility, segmentation, controlled access, and response planning that respects operational constraints.

How attacks enter (common exposure paths)

Most critical infrastructure incidents start with familiar entry points. In many environments, attackers do not need a novel exploit. They need a weak access path and time.

• Remote access: exposed services, weak authentication, shared accounts, or unmanaged vendor access.
• IT compromise then pivot: phishing or credential theft in IT networks, then lateral movement toward OT.
• Flat networks: weak segmentation that allows a compromise to move into control systems.
• Misconfigurations: permissive firewall rules, outdated protocols, and inconsistent identity controls.

Practical controls (high leverage in the real world)

You do not need a perfect program to reduce risk quickly. Start with controls that improve safety, reduce exposure, and create measurable visibility.

1) Build an accurate asset inventory

You cannot protect what you cannot see. Know what is on your OT network, what it talks to, and what “normal” looks like. In OT, passive discovery and network visibility are often safer than aggressive probing.

2) Harden remote access

Remote access is one of the highest-risk paths and one of the easiest to improve. Use strong authentication (including MFA where possible), route access through controlled jump hosts, log sessions, and remove access when it is not needed.

3) Segment networks and protect boundaries

Separate OT from IT with properly configured firewalls. Use a DMZ where appropriate. Treat the boundaries where OT connects to IT, the internet, or vendor systems as high-sensitivity choke points.

4) Monitor for change and anomaly

OT monitoring is about detection of change: new devices, new communications, unusual commands, and access at unusual times. Even simple monitoring can help you spot drift and identify compromised paths earlier.

5) Practice incident response for OT

A good response plan is not a binder. It is a set of decisions you have made in advance: how to isolate safely, when to shift to manual operations, who has authority, and how you communicate with regulators and stakeholders.

Safe assessments (validate without breaking operations)

Traditional IT penetration testing does not always translate directly to OT environments. Testing that is routine in an enterprise network can disrupt industrial processes or damage equipment. Assessments should be scoped and staged with operational safety in mind.

Practical approaches include architecture reviews, passive discovery, and risk-based validation during maintenance windows or in lab environments where possible. The goal is to understand vulnerabilities and attack paths without creating outages.

Guidance and compliance (use the right references)

When you need authoritative guidance, start with well-established resources and adapt them to your environment.

• NIST SP 800-82 for industrial control system security guidance.
• CISA ICS resources for advisories and operational guidance.
• Canadian Centre for Cyber Security for Canada-focused guidance and recommendations.

Requirements vary by sector and jurisdiction. If compliance frameworks apply to your environment, use them as a baseline, but do not treat compliance as a substitute for risk reduction.

Getting started

If you operate critical infrastructure and you are not confident in your OT security posture, start with a focused assessment that respects operational constraints. The goal is clarity: what is exposed, what paths exist, and what changes reduce the most risk.

If you suspect an incident or need rapid scoping, start with Compromise Assessment. For adversary simulation and validation of real-world readiness, explore Red Teaming.

Written by

Phillip Williams

Co-Founder & CTO

Phillip Williams is a Google Hall of Fame hacker and veteran security engineer. He has discovered critical vulnerabilities across global platforms and holds multiple patents in streaming and microservice infrastructure. He has founded and scaled several cybersecurity startups and built systems that protect millions of users worldwide. At TechSlayers, he leads architecture and product innovation, designing technology that makes isolation fast, invisible, and secure.