OTVista
Book a demo

OT cybersecurity for water and critical infrastructure

Water and wastewater utilities operate treatment plants and widely distributed pumping and storage sites, often with small technical teams. Practical, proportionate security matters more than complex tooling.

Industry sheet
Sector
Water and critical infrastructure
Representative systems
5
Typical challenges
5
Example
Illustrative

Industry context

Covers:

  • Drinking water
  • Wastewater
  • District heating and cooling
  • Other essential services

Utilities supervise treatment plants, reservoirs, pumping stations and network sites through SCADA and telemetry. Many outstations use cellular or radio links and are visited only occasionally.

Teams are often small, and integrators may have built and still support large parts of the system. Security improvements must be sustainable with the people available.

Reference architecture

Site E: Water utility

A control room supervising a treatment plant and remote pumping sites over telemetry. Select a zone to see its role, key risks and recommended controls.

Site E Water utilityA control room supervising a treatment plant and remote pumping sites over telemetry.
Site E: Water utility OT reference architecture (Water and critical infrastructure) L4 L3.5 L3 L1–L2 L0 Corporate WS, Enterprise IT Corporate WS Billing / CRM, Enterprise IT Billing / CRM GIS, Enterprise IT GIS Edge router, Enterprise IT Edge router Historian mirror, Utility DMZ Historian mirror Remote access, Utility DMZ Remote access Reporting, Utility DMZ Reporting DMZ switch, Utility DMZ DMZ switch SCADA server, Control room SCADA server Operator HMI, Control room Operator HMI Historian, Control room Historian Engineering WS, Control room Engineering WS Core switch, Control room Core switch Treatment PLC, Treatment plant Treatment PLC Local HMI, Treatment plant Local HMI Dosing PLC, Treatment plant Dosing PLC Plant switch, Treatment plant Plant switch Outstation, Remote sites (telemetry) Outstation Pump station, Remote sites (telemetry) Pump station Radio link, Remote sites (telemetry) Radio link VPN gateway, Remote sites (telemetry) VPN gateway Chlorine dosing, Process and field Chlorine dosing Level sensor, Process and field Level sensor Flow meter, Process and field Flow meter Booster pump, Process and field Booster pump Reservoir, Process and field Reservoir Enterprise ITIT Utility DMZSL 2 Firewall: HTTPS, reporting exportsHTTPS, reporting exports Control roomSL 2 Firewall: OPC, historian replicationOPC, historian replication Treatment plantSL 3 Firewall: Modbus TCP, DNP3Modbus TCP, DNP3 Remote sites (telemetry)SL 2 Firewall: DNP3 over private APN / VPNDNP3 over private APN / VPN Process and fieldSL 2 Assessment scope
Enterprise ITDMZOT operationsCritical controlField / safety

Tap a zone for its risks and controls, or a device for its security requirements.

Illustrative reference architectures, simplified for clarity. Security levels shown are example targets. Not live data.

Representative OT systems and dependencies

  • SCADA and telemetryCentral supervision of treatment and network sites.
  • RTUs and outstation PLCsRemote controllers at pumping stations, reservoirs and network sites.
  • Treatment process controlPLCs and HMIs controlling dosing, filtration and treatment stages.
  • Communications infrastructureCellular, radio and fixed links to remote sites.
  • Monitoring and quality systemsInstrumentation and data systems for compliance reporting.

Common cybersecurity challenges

  • Remote telemetryMany small sites connected over public or shared networks.
  • Lean teamsLimited in-house OT security capacity.
  • Integrator dependenceKey knowledge and access held by external parties.
  • Operational resilienceThe need to keep treatment running and recover quickly.
  • RegulationGrowing expectations for essential service operators.

Relevant assessment areas

  • Telemetry communications security
  • Integrator remote access
  • SCADA server and HMI hardening
  • Backup and manual operation readiness
  • Asset inventory of outstations
  • Proportionate policies and procedures

Relevant OTVista services

A proportionate first assessment for a regional utility

Illustrative example

Situation

A regional water utility needs to show progress on OT security but has a small team and limited budget.

Result

The utility gets a realistic plan it can deliver, starting with the measures that most improve resilience.

Structured approach

  1. Focus the assessment on a short list of high-value controls.
  2. Review telemetry links and remote access first.
  3. Confirm backups and manual operation procedures for key sites.
  4. Produce a roadmap sized to the team's capacity.

This scenario is a hypothetical example of a common situation in the sector, not a description of OTVista client work.

Questions from water and critical infrastructure teams

Our team is small. Where should we focus first?

Typically on remote access, backups and recovery, basic segmentation and knowing which assets you have. These give the most resilience for the effort.

Are cellular-connected outstations a risk?

They can be if they are reachable from the internet or poorly authenticated. Private APNs, VPNs, restricted inbound access and monitoring reduce that exposure.

From the blog

Latest OT security insights

All posts

Discuss OT cybersecurity for your operations

Tell us about your sites, systems and priorities, and we'll suggest a practical starting point.

Request a consultation