Water Plant Security: A Complete Guide to Protecting Treatment Facilities

In the past five years, water plant security has moved from an afterthought to a boardroom priority. The 2021 Oldsmar, Florida attack—where an intruder remotely accessed the HMI and increased sodium hydroxide levels to 100x the normal concentration—exposed just how vulnerable water treatment SCADA systems can be. Since then, EPA enforcement actions, CISA advisories, state-level mandates, and Congressional attention have made water plant security a compliance requirement, not just an industry best practice.

This guide provides a practical framework for water and wastewater utilities of all sizes looking to strengthen their water plant security posture across both physical and cyber domains.

The Current Threat Landscape for Water Utilities

Water utilities face a unique combination of challenges that make water plant security particularly complex compared to other critical infrastructure sectors:

• Distributed infrastructure: Treatment plants, booster pump stations, distribution system pressure zones, water towers, and raw water intake facilities spread across wide service areas—often with minimal physical security at remote sites
• Legacy SCADA systems: Many utilities operate control systems deployed 10-20 years ago with outdated operating systems, unpatched software, and unsupported hardware that contain known vulnerabilities
• Limited IT/OT security staff: The American Water Works Association estimates that 80% of U.S. water systems serve fewer than 10,000 people and most have no dedicated cybersecurity personnel. Many rely on a single operator who also manages the SCADA system.
• Direct public health consequence: Unlike most cyberattacks that cause financial or reputational damage, a successful attack on chemical dosing, disinfection, or treatment processes directly endangers public health and safety. The stakes are life-or-death.
• Publicly accessible facilities: Many water towers, pump stations, and distribution system components are located in public areas with minimal fencing or access control.

According to the Water Information Sharing and Analysis Center (WaterISAC), reported cyber incidents targeting water and wastewater utilities increased 300% between 2020 and 2025. The threat actors range from nation-state groups (IRGC-affiliated Cyber Av3ngers targeting Unitronics PLCs) to ransomware gangs, hacktivists, and even disgruntled insiders.

5 Pillars of Water Plant Security

Pillar 1: SCADA and Network Security

The SCADA system is the central nervous system of any water treatment facility. Water plant security fundamentally depends on hardening this infrastructure against both external and internal threats:

• Segment the OT/SCADA network from the corporate IT network using firewalls and an industrial demilitarized zone (iDMZ)—no direct paths between email/internet and process control
• Eliminate default credentials on every PLC, RTU, HMI workstation, managed switch, and wireless access point before commissioning
• Deploy encrypted communications for all remote SCADA connections—cellular VPN, DNP3 Secure Authentication, or OPC UA with TLS
• Implement SCADA security best practices including regular vulnerability assessments and penetration testing of the OT network
• Maintain a complete, current inventory of all connected devices, their firmware versions, and known CVE exposure
• Back up all PLC programs, HMI configurations, and SCADA databases on a regular schedule with offline copies stored securely

Pillar 2: Access Control

Water plant security requires controlling who can access what—both physically and digitally—with the principle of least privilege:

• Implement role-based access control (RBAC) for all SCADA/HMI logins—operators see what they need, engineers have elevated but logged access, no one has unnecessary administrator privileges
• Require multi-factor authentication (MFA) for all remote access connections without exception
• Maintain comprehensive audit logs of all access events—logins, configuration changes, setpoint modifications, and alarm acknowledgments
• Restrict physical access to control rooms, chemical storage facilities, and communications equipment with keyed/badge access and security cameras
• Issue unique credentials to every operator and contractor—eliminate all shared accounts and generic logins
• Implement immediate credential revocation procedures for terminated employees and completed contractor engagements

Pillar 3: Monitoring and Detection

You cannot defend what you cannot see. Effective water plant security requires continuous, automated monitoring of both physical and cyber domains:

• Deploy OT-specific network intrusion detection systems (Claroty, Nozomi, Dragos) that understand Modbus, DNP3, and other SCADA protocols
• Monitor for unauthorized changes to PLC ladder logic, HMI screens, chemical dosing setpoints, and disinfection parameters
• Establish baseline network traffic patterns during normal operations and configure alerts for statistical deviations
• Integrate physical security cameras, perimeter intrusion detection, and door access sensors with centralized alarm management
• Deploy water quality monitoring sensors at key treatment stages that alarm on parameter deviations independent of the SCADA system

Pillar 4: Incident Response Planning

Every water utility needs a tested incident response plan that addresses the unique operational constraints of a treatment facility. Unlike IT systems, you cannot simply shut down a water treatment plant, wipe the servers, and rebuild—the community depends on continuous water service. Your water plant security incident response plan should address:

• Procedures for isolating compromised SCADA segments without interrupting treatment processes or water distribution
• Documented manual override procedures for all critical processes: disinfection, chemical dosing, pH adjustment, and distribution pressure management
• Communication protocols and contact trees for state drinking water agencies, EPA Region office, CISA, WaterISAC, and local law enforcement
• Contact information for your SCADA system integrator, network security consultants, and legal counsel
• Evidence preservation procedures that maintain chain of custody for potential law enforcement investigation
• Recovery procedures including validated PLC program backups, SCADA configuration restore, and post-incident verification testing

Pillar 5: Compliance and Governance

Water plant security is increasingly a regulatory requirement with enforcement consequences for non-compliance:

• America’s Water Infrastructure Act (AWIA): Requires risk and resilience assessments (RRAs) and emergency response plans (ERPs) for all community water systems serving more than 3,300 people. Updates are required every 5 years.
• EPA enforcement: The EPA has significantly increased inspections of water utility cybersecurity practices following high-profile incidents. Facilities found lacking face enforcement orders and potential penalties.
• CISA resources: CISA provides free services to water utilities including vulnerability scanning, security architecture reviews, phishing assessments, and tabletop exercise facilitation through their regional cybersecurity advisors.
• State mandates: Several states including Texas, New Jersey, and Virginia now require documented cybersecurity plans for public water systems, with more states expected to follow.
• WaterISAC membership: The Water ISAC provides sector-specific threat intelligence, incident alerts, best practices, and a community of peers focused on water plant security.

Common Water Plant Security Mistakes to Avoid

In our experience working with water and wastewater utilities across the country, these are the most frequent water plant security mistakes we encounter:

• Using TeamViewer, AnyDesk, or consumer-grade remote access tools for SCADA access
• Running Windows 7 or XP on HMI workstations connected to the internet
• Using shared operator accounts that make audit logging meaningless
• No backup of PLC programs—if a PLC fails, no one knows what logic was running
• Treating cybersecurity as an IT-only responsibility without involving operations staff

How Pro-Tech Strengthens Water Plant Security

Pro-Tech Systems Group provides comprehensive water plant security solutions including SCADA system modernization, secure telemetry networks, IT/OT network segmentation design, access control implementation, and ongoing monitoring support. We understand the operational realities of water treatment and wastewater processing facilities and design security solutions that protect your infrastructure without disrupting the 24/7 operations your community depends on.

Contact Pro-Tech Systems Group to schedule a water plant security assessment. Call (330) 773-9828.