Late July brought a run of intrusions against U.S. drinking-water and wastewater systems that were aimed at the equipment, not the inbox. On 1 October, NIST’s National Cybersecurity Center of Excellence described what investigators had in hand. Alerts from CISA, the FBI, and the EPA pointed to internet-facing components ordinary in these plants. Controllers were reached without authorization. NIST’s account of intent is plain: change settings, shrink what staff could monitor and command, disrupt treatment. In the cases the center discusses, passwords and IP addresses on the units were changed, and the people who were supposed to operate them were locked out.
The sector’s shape makes that pattern uneven. NIST cites nearly 50,000 community water systems and more than 16,000 wastewater systems. About 1 percent of utilities are very large and together serve close to half the population. More than 80 percent are small, each serving 3,300 people or fewer. A shared login and a controller that answers from the public internet are still, in many of those small systems, how the night shift reaches a pump station.
NIST SP 1800-45, the remote-access architectures the center demonstrated for this sector, is the preventive half. A conventional plant can put firewalls in front of a remote-access server and restrict who may touch which asset. A small utility that cannot staff that stack is shown a cloud access plane with logging. Sites that already exchange process data without a person in the middle are shown encrypted links between them. Useful, and none of it answers the question July actually left on the console: the HMI will not open, so what is the wet well, the residual, the discharge pressure doing?
A mechanical gauge, a local display that is not the controller’s web page, and a known-good copy of the logic—compared with whatever is running—are dull on purpose. They separate “we cannot log in” from “we no longer know whether the pump matches the permit.” NIST is explicit that a utility with working defenses can still lose service. The work is to make that interval short. The center’s next project is asset visibility, for the obvious reason that a remote-access rule cannot cover a controller nobody listed.
Unmanned stations miles from the plant are not going back to a pure air gap. Leaving their controllers as public web pages, with a configuration an outsider can rewrite, is how a screen and a basin stop describing the same night. Inventory, a remote path that is actually access control, and a measurement the intruder did not get to rename are the operational remainder.