It’s difficult to imagine a more critical piece of infrastructure than the systems that deliver clean water to our homes, and carry away wastewater for treatment. Like most critical infrastructure, these systems are often out of sight and out of mind, yet also underpin our everyday lives. As cyber attackers have expanded both their capabilities and boldness, these critical systems are increasingly under attack, as evidenced by recent events. Though the ultimate impact of these attacks was far from catastrophic, they do illustrate the urgent need for operational technology (OT) owners and operators to embark on a zero trust transformation of their network architecture, and prevent potentially disastrous outcomes. What happened?In late July/early August 2026, the FBI, EPA, and CISA jointly published warnings of ongoing cyber attacks against water treatment systems across a multitude of states, with Minnesota bearing the brunt of the attacks. Details are limited, but here’s what has been publicly confirmed:The attacks were primarily directed at internet-connected programmable logic controllers (PLCs), including some cellular-connected devices. Having gained access to PLCs, attackers made configuration changes to these devices, including password changes and IP address changes, leading to a loss of control and/or visibility for plant personnel. At least one affected organization observed modified project files, indicating that attackers were attempting to modify the programmed behavior of the PLC itselfAffected utilities responded in a variety of ways; most were able to continue operations without any disruptions to service or safety concerns by switching to manual operating mode, while others issued customer conservation requests or boil-water notices in response to a loss of water pressure inside the systemThis series of attacks is noteworthy in its simplicity; unlike other OT cyber attacks that require an initial exploitation of enterprise IT systems before laterally moving into OT networks, these attacks instead were able to directly target PLCs from the Internet. Additionally, it does not appear that any ransomware or other sophisticated malware was deployed, but rather simply using the built-in functionality of the PLCs themselves to achieve the desired effects. Despite the overall effects of the attacks being rather mild, the implications of attackers being able to directly target water infrastructure from the Internet are troubling, and we should not use the lack of damage as an excuse to avoid difficult conversations around OT cybersecurity.Along with warnings and updates, the aforementioned government agencies have also provided some remediation guidance in the wake of these attacks. Each publication provides its own set of recommended actions, with some variation between them, but generally boiling down to a core set of fundamental security controls:Remove PLC exposure to the Internet. This is top of the list for just about every guidance that has been issued, and for good reason; having OT devices discoverable from the Internet makes an attacker’s life easy, as reconnaissance, targeting, and exploitation can all be easily automated. Secure and control remote access – Eliminate inbound port exposure entirely. Any required remote access must be brokered through a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access.Audit cellular and modem connections – Vendor-installed cellular modems are a well-documented blind spot. Agencies specifically called out undocumented cellular connections as a primary attack vector in this campaign.Enforce IP allowlisting and device hardening – Restrict PLC communications to known, authorized engineering workstations. For the PLCs themselves, change default credentials and ensure the device is operating in “run” mode.Maintain manual operations capability. The operators who fared best in this campaign were those who could fall back to manual control quickly. This resilience posture should be regularly drilled.Keep clean, verified PLC backups. Maintain known-good backups of all PLC configurations and project files. Validate against baseline before restoration.These sorts of foundational security actions are a good beginning, but ultimately fall short of what critical infrastructure cybersecurity should look like. Let’s take a closer look at how a more in-depth transformation of OT architecture can provide much stronger security without incurring a high price tag. Beyond firewalls with Zscaler Zero TrustMost OT networks rely on a sort of “chocolate candy” model: think hard shell, soft center. This is to say that OT networks, when adhering to the aforementioned security guidelines, present a fairly strong exterior security posture, with firewalls and VPNs preventing direct access to OT devices from the Internet. However, if and when this exterior is breached (whether via stolen credentials, phishing emails, supply chain compromise, etc.), there is typically little stopping attackers from using their network access to move laterally, deploy malware, and ultimately deliver effects against their desired targets. The root of this weakness lies in the inherent trust provided by network access, and trying to layer on additional perimeter security tools is choosing to engage in a persistent cat-and-mouse game with attackers, often from a position of weakness. A more durable solution is to execute a zero trust transformation of OT networks, and replace inherent trust zones with microsegmentation, brokered access, and policy enforcement directly at the resource level. Zscaler’s OT capabilities are built around one principle that delivers on all of these — every device, every user, and every session connects only to the Zscaler Zero Trust Exchange. Nothing talks directly to anything else. Let’s take a closer look at the individual components that make this possible: Zero Trust Branch (ZT Branch) – No Attack SurfaceWhen a water utility deploys ZT Branch, the OT site connects outbound to the Zero Trust Exchange. That is the only connection it makes. There are no listening ports, no inbound connections, no routable address that a scanner can find. The plant is invisible to the outside world. An attacker running the same automated scans that located the Minnesota utilities’ PLCs finds nothing to target. From there, the Zero Trust Exchange brokers access to specific applications and devices based on identity and policy. Furthermore, ZT Branch also provides microsegmentation by isolating every device in the network into a “network-of-one”, eliminating broad implicit trust zones within VLANs. This allows OT defenders the ability to scrutinize all traffic flows, and allows only those communication paths that are explicitly defined; for an OT network, think of moving from “Everything in 10.10.10.1/24 can talk to each other” to “only HMIs tagged as water-HMI can communicate with PLCs tagged as water-PLC over Modbus TCP.” By shrinking attackers’ maneuverability, defenders can much more easily deploy controls, log suspicious behavior, and take action as needed. Furthermore, microsegmentation provides resiliency by limiting the “blast radius” of successful attacks. Even a compromised device can only impact the devices it’s allowed to talk to, leaving the rest of the network intact. Zero Trust Cellular — Secure Access From AnywhereThe July 30 advisory called out cellular-connected PLCs as a primary attack vector. Plymouth, Minnesota is the clearest example: a vendor-installed cellular modem on a water tower, no authentication, directly internet-reachable. Zscaler Cellular addresses this with the same architecture as ZTB. A data-only SIM connects the field device outbound to the Zero Trust Exchange. No VPN hardware. No agent. No public IP address. The cellular-connected pump, sensor, or remote lift station talks only to the Zero Trust Exchange, and from there only to what policy permits. With many OT assets deployed in physically remote locations, ensuring this access is secured to the same standard as the rest of the enterprise is crucial for operational efficiency.Privileged Remote Access (PRA) — The Secure ProxyThe major weakness of a VPN-based approach for remote access is that the network itself is fundamentally extended out to the Internet. Even with firewalls and strong credentials in place, if and when VPNs are compromised, attackers now have a level of access that is just as good as being in the plant with a laptop. Just as ZTB eliminates the need for inbound connections to the plant, so too does PRA eliminate the structural weakness of a VPN. Here’s the flow: a contractor or OEM engineer opens a browser, authenticates with MFA, and requests access to a specific target — say, a SCADA portal. Your team approves the request just-in-time, bound to a defined window. The session runs over RDP, VNC, or SSH, brokered through the Zero Trust Exchange. Three things follow from that model:The vendor’s laptop never touches your OT network.No persistent tunnel sits open between visits.When the session ends, the access ends.With PRA, utilities can give their vendors and contractors just the right access, at the right time, all without serving up a target for attackers. Deception — Tripping The AlarmA fundamental aspect of zero trust is the assumption that the network has been breached. Despite defenders’ best efforts, attackers are clever, motivated, and increasingly leveraging AI to penetrate even the best defended networks; this creates a need for knowing when attackers have made their entry. With Zscaler Deception, OT defenders can place realistic-looking systems in the path of attackers to serve as a canary: if these systems are ever touched, that’s a guaranteed sign of trouble afoot. These decoys are ideal for OT environments, as there’s no need to modify the real production systems in any way, leaving operations intact. Putting It All TogetherBy combining microsegmentation, secure remote access, and deception technology, Zscaler can empower water utilities to eliminate their plant’s public attack surface, adhere to least-privilege principles for network access, take away lateral movement possibilities, alert to suspicious activity, and contain the impact of cyber attacks. With fresh momentum around securing critical infrastructure through new advisory bodies, subsidized AI for critical infrastructure defenders, and initiatives like Texas’ Project Watershed 250 (which Zscaler is proud to support), there is no better time for critical infrastructure owners and operators to begin their zero trust transformation. Zscaler is ready to help fix your leaks, and secure the future of water.Ready to learn more?Start Microsegmentation Journey with Zero Trust BranchLearn about Eaton’s journey: Eaton Secures Global Operations with AI-Powered Segmentation
[#item_full_content] It’s difficult to imagine a more critical piece of infrastructure than the systems that deliver clean water to our homes, and carry away wastewater for treatment. Like most critical infrastructure, these systems are often out of sight and out of mind, yet also underpin our everyday lives. As cyber attackers have expanded both their capabilities and boldness, these critical systems are increasingly under attack, as evidenced by recent events. Though the ultimate impact of these attacks was far from catastrophic, they do illustrate the urgent need for operational technology (OT) owners and operators to embark on a zero trust transformation of their network architecture, and prevent potentially disastrous outcomes. What happened?In late July/early August 2026, the FBI, EPA, and CISA jointly published warnings of ongoing cyber attacks against water treatment systems across a multitude of states, with Minnesota bearing the brunt of the attacks. Details are limited, but here’s what has been publicly confirmed:The attacks were primarily directed at internet-connected programmable logic controllers (PLCs), including some cellular-connected devices. Having gained access to PLCs, attackers made configuration changes to these devices, including password changes and IP address changes, leading to a loss of control and/or visibility for plant personnel. At least one affected organization observed modified project files, indicating that attackers were attempting to modify the programmed behavior of the PLC itselfAffected utilities responded in a variety of ways; most were able to continue operations without any disruptions to service or safety concerns by switching to manual operating mode, while others issued customer conservation requests or boil-water notices in response to a loss of water pressure inside the systemThis series of attacks is noteworthy in its simplicity; unlike other OT cyber attacks that require an initial exploitation of enterprise IT systems before laterally moving into OT networks, these attacks instead were able to directly target PLCs from the Internet. Additionally, it does not appear that any ransomware or other sophisticated malware was deployed, but rather simply using the built-in functionality of the PLCs themselves to achieve the desired effects. Despite the overall effects of the attacks being rather mild, the implications of attackers being able to directly target water infrastructure from the Internet are troubling, and we should not use the lack of damage as an excuse to avoid difficult conversations around OT cybersecurity.Along with warnings and updates, the aforementioned government agencies have also provided some remediation guidance in the wake of these attacks. Each publication provides its own set of recommended actions, with some variation between them, but generally boiling down to a core set of fundamental security controls:Remove PLC exposure to the Internet. This is top of the list for just about every guidance that has been issued, and for good reason; having OT devices discoverable from the Internet makes an attacker’s life easy, as reconnaissance, targeting, and exploitation can all be easily automated. Secure and control remote access – Eliminate inbound port exposure entirely. Any required remote access must be brokered through a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access.Audit cellular and modem connections – Vendor-installed cellular modems are a well-documented blind spot. Agencies specifically called out undocumented cellular connections as a primary attack vector in this campaign.Enforce IP allowlisting and device hardening – Restrict PLC communications to known, authorized engineering workstations. For the PLCs themselves, change default credentials and ensure the device is operating in “run” mode.Maintain manual operations capability. The operators who fared best in this campaign were those who could fall back to manual control quickly. This resilience posture should be regularly drilled.Keep clean, verified PLC backups. Maintain known-good backups of all PLC configurations and project files. Validate against baseline before restoration.These sorts of foundational security actions are a good beginning, but ultimately fall short of what critical infrastructure cybersecurity should look like. Let’s take a closer look at how a more in-depth transformation of OT architecture can provide much stronger security without incurring a high price tag. Beyond firewalls with Zscaler Zero TrustMost OT networks rely on a sort of “chocolate candy” model: think hard shell, soft center. This is to say that OT networks, when adhering to the aforementioned security guidelines, present a fairly strong exterior security posture, with firewalls and VPNs preventing direct access to OT devices from the Internet. However, if and when this exterior is breached (whether via stolen credentials, phishing emails, supply chain compromise, etc.), there is typically little stopping attackers from using their network access to move laterally, deploy malware, and ultimately deliver effects against their desired targets. The root of this weakness lies in the inherent trust provided by network access, and trying to layer on additional perimeter security tools is choosing to engage in a persistent cat-and-mouse game with attackers, often from a position of weakness. A more durable solution is to execute a zero trust transformation of OT networks, and replace inherent trust zones with microsegmentation, brokered access, and policy enforcement directly at the resource level. Zscaler’s OT capabilities are built around one principle that delivers on all of these — every device, every user, and every session connects only to the Zscaler Zero Trust Exchange. Nothing talks directly to anything else. Let’s take a closer look at the individual components that make this possible: Zero Trust Branch (ZT Branch) – No Attack SurfaceWhen a water utility deploys ZT Branch, the OT site connects outbound to the Zero Trust Exchange. That is the only connection it makes. There are no listening ports, no inbound connections, no routable address that a scanner can find. The plant is invisible to the outside world. An attacker running the same automated scans that located the Minnesota utilities’ PLCs finds nothing to target. From there, the Zero Trust Exchange brokers access to specific applications and devices based on identity and policy. Furthermore, ZT Branch also provides microsegmentation by isolating every device in the network into a “network-of-one”, eliminating broad implicit trust zones within VLANs. This allows OT defenders the ability to scrutinize all traffic flows, and allows only those communication paths that are explicitly defined; for an OT network, think of moving from “Everything in 10.10.10.1/24 can talk to each other” to “only HMIs tagged as water-HMI can communicate with PLCs tagged as water-PLC over Modbus TCP.” By shrinking attackers’ maneuverability, defenders can much more easily deploy controls, log suspicious behavior, and take action as needed. Furthermore, microsegmentation provides resiliency by limiting the “blast radius” of successful attacks. Even a compromised device can only impact the devices it’s allowed to talk to, leaving the rest of the network intact. Zero Trust Cellular — Secure Access From AnywhereThe July 30 advisory called out cellular-connected PLCs as a primary attack vector. Plymouth, Minnesota is the clearest example: a vendor-installed cellular modem on a water tower, no authentication, directly internet-reachable. Zscaler Cellular addresses this with the same architecture as ZTB. A data-only SIM connects the field device outbound to the Zero Trust Exchange. No VPN hardware. No agent. No public IP address. The cellular-connected pump, sensor, or remote lift station talks only to the Zero Trust Exchange, and from there only to what policy permits. With many OT assets deployed in physically remote locations, ensuring this access is secured to the same standard as the rest of the enterprise is crucial for operational efficiency.Privileged Remote Access (PRA) — The Secure ProxyThe major weakness of a VPN-based approach for remote access is that the network itself is fundamentally extended out to the Internet. Even with firewalls and strong credentials in place, if and when VPNs are compromised, attackers now have a level of access that is just as good as being in the plant with a laptop. Just as ZTB eliminates the need for inbound connections to the plant, so too does PRA eliminate the structural weakness of a VPN. Here’s the flow: a contractor or OEM engineer opens a browser, authenticates with MFA, and requests access to a specific target — say, a SCADA portal. Your team approves the request just-in-time, bound to a defined window. The session runs over RDP, VNC, or SSH, brokered through the Zero Trust Exchange. Three things follow from that model:The vendor’s laptop never touches your OT network.No persistent tunnel sits open between visits.When the session ends, the access ends.With PRA, utilities can give their vendors and contractors just the right access, at the right time, all without serving up a target for attackers. Deception — Tripping The AlarmA fundamental aspect of zero trust is the assumption that the network has been breached. Despite defenders’ best efforts, attackers are clever, motivated, and increasingly leveraging AI to penetrate even the best defended networks; this creates a need for knowing when attackers have made their entry. With Zscaler Deception, OT defenders can place realistic-looking systems in the path of attackers to serve as a canary: if these systems are ever touched, that’s a guaranteed sign of trouble afoot. These decoys are ideal for OT environments, as there’s no need to modify the real production systems in any way, leaving operations intact. Putting It All TogetherBy combining microsegmentation, secure remote access, and deception technology, Zscaler can empower water utilities to eliminate their plant’s public attack surface, adhere to least-privilege principles for network access, take away lateral movement possibilities, alert to suspicious activity, and contain the impact of cyber attacks. With fresh momentum around securing critical infrastructure through new advisory bodies, subsidized AI for critical infrastructure defenders, and initiatives like Texas’ Project Watershed 250 (which Zscaler is proud to support), there is no better time for critical infrastructure owners and operators to begin their zero trust transformation. Zscaler is ready to help fix your leaks, and secure the future of water.Ready to learn more?Start Microsegmentation Journey with Zero Trust BranchLearn about Eaton’s journey: Eaton Secures Global Operations with AI-Powered Segmentation
