OT Security Audit of a Wastewater Treatment Facility
The Challenge
The facility ran on a control network built up over years, with integrator remote access, shared operator accounts, and no clear boundary between business systems and process control.
Public incidents at similar plants had raised the stakes: the operator needed to know its exposure and a practical plan, with no risk to treatment processes or safety systems.
“They understood that a treatment plant cannot just be taken offline for testing. We got a real picture of our risk and a plan we could fund.”
The Execution
Inventory
Passive discovery and walkdowns produced a complete list of PLCs, HMIs, and network links, including a forgotten integrator modem.
Review
Controller and SCADA configurations were reviewed for default credentials, exposed engineering functions, and paths to safety-instrumented systems.
Assess
Remote access and IT/OT boundary testing, coordinated with operators, confirmed which routes an attacker could use from the business network.
Plan
We designed zones and conduits, recommended monitoring for industrial protocols, and sequenced the work to match budget and maintenance windows.
The Outcome
Unmanaged remote access was removed, shared accounts were replaced with individual credentials, and the first segmentation phase was completed without disrupting treatment.
The operator now has a funded, multi-year OT security plan and evidence for its regulator.