Recommended Free Tools
Keep programmable logic controllers (PLCs) off the public internet. Separate operational technology (OT) from information technology (IT), and allow any necessary traffic between them only through a controlled, monitored boundary. Start by mapping assets and operational communications; then permit only the connections the utility needs, protect remote access at the boundary, and log activity.
What a safe OT boundary should do
Network segmentation is the arrangement of networks and the controls between them so that a connection to one part does not automatically provide access to another. For a water utility, the goal is to keep the OT network that supports operations distinct from IT and public-facing networks while preserving explicitly needed communications.
As an Amazon Associate I earn from qualifying purchases.
EPA and CISA’s September 2024 EPA Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems recommends denying connections to OT by default, allowing only those explicitly needed, and routing OT–IT connections through an intermediary that is monitored and logged. The appropriate boundary may use a firewall, proxy, gateway, VPN, bastion host, jump box, or a demilitarized zone (DMZ). The guidance does not prescribe one universal topology or product.
Map assets and required traffic before changing rules
First establish what is connected and which communications operations rely on. CISA, EPA, and FBI’s February 21, 2024 Top Cyber Actions for Securing Water Systems calls for OT and IT asset inventory and cybersecurity assessments.
#1 Best Overall
- Inventory OT and IT assets, including PLCs and human-machine interfaces (HMIs). Record their network locations and known public-facing exposure.
- Identify vendors, remote-access methods, and the paths used to reach OT equipment.
- Document operationally required communications between OT, IT, and external parties. Record the endpoints and purpose of each known connection.
- Compare the inventory with the current network layout and access rules. Investigate paths that are exposed, undocumented, or no longer needed before deciding whether to block them.
This map is the basis for specific allow rules. A rule that is too broad can undermine separation; a rule that blocks a required operational flow can interrupt work. The cited guidance calls for restricting OT connections but does not supply a utility-specific list of ports, protocols, or endpoints.
Remove direct public-internet access to PLCs
Do not leave a PLC directly reachable from the public-facing internet. CISA and partner agencies’ advisory IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities, last revised December 18, 2024, identifies disconnecting PLCs from the public-facing internet as an immediate mitigation.
Rank #2
- 【◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Compatible with OPNsense, Linux, Windows,ESXI, OpenWrt and other systems. Press "Delete" key to enter BIOS setup, supports Auto Power On, Wake On Lake, GPIO, PXE
- 【◆1GbE LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD+1x2.5''SATA3.0 SSD/HDD.
- ◆UHD Graphics & Dual Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Rich interfaces: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.
Where remote access is operationally required, the advisory says: “If remote access is required, implement a network proxy, gateway, firewall and/or virtual private network (VPN) in front of the PLC to control network access.” The control should sit between the outside connection and the PLC rather than making the PLC itself publicly reachable.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRoute necessary access through a controlled boundary
Use a clearly defined boundary between OT and other networks. Place intermediary controls on each path that crosses that boundary, including remote-access paths. Configure access so that connections are denied unless they have been explicitly allowed for an operational need. Monitor and log traffic at the intermediary, as EPA and CISA recommend.
Rank #3
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
For access to HMIs, CISA and EPA’s December 13, 2024 fact sheet, Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems, recommends a DMZ or bastion host at the OT boundary, multifactor authentication (MFA), IP allowlisting, and logging remote logins. Apply these controls to the access design where supported by the utility’s architecture and operational requirements; the fact sheet does not establish that one arrangement fits every site.
Choose controls by their job, not by name
Official water-sector guidance names several possible controls and patterns, but does not rank them or specify a universally preferred product. Evaluate a proposed design against the utility’s actual network and required operations.
Rank #4
- Low Power J6413 Processor: Glovary J6413 4L micro firewall appliance uses Celeron J6413 processor, 4 Cores, 4 Threads, up to 3.0 GHz. J6413 4L features low power consumption and high energy efficiency, making it suitable for long-term stable work and supporting Auto Power On
- 4 x i226V 2.5GbE LAN: J6413 4L firewall router with 4 x i226V 2.5GbE LAN provides higher network speed, faster data transfer, and smoother virtualization. J6413 4L also offers better performance for multi-VM workloads and more efficient multi-LAN routing
- 2 x DDR4 RAM & 2 x NVMe: J6413 4L network hardware firewall features 2 x DDR4 RAM SO-DIMM memory (up to 64GB), 2 x M.2 2280 NVMe SSD slots, and 2 x SATA 3.0 slots for 2.5" HDDs (SATA cables included), providing larger storage capacities and more efficient data management
- 2HD + USB-C 3 Display: J6413 4L firewall box PC with 2 x HDMI + USB-C 3 display interfaces, integrated UHD Graphics, supports multi-screen setups, enabling efficient, simultaneous display of network activity for better control and visibility
- Fanless Design Mini Size: Glovary J6413 4L firewall device with aluminium alloy body, fanless quiet running without noise. Its compact size (17.7 cm x 12.5 cm x 5.5 cm, 1.2 kg) makes it ideal for home labs and enterprise network security applications
| Control or pattern | What to establish for your design | What the cited guidance establishes |
|---|---|---|
| Firewall | Where it sits, which connections it permits or denies, and how rules are monitored and logged. | Named as a possible boundary control; no product, rule set, or ranking is specified. EPA and CISA, September 2024; CISA advisory, revised December 18, 2024. |
| Proxy or gateway | Which access paths it mediates and whether it supports the utility’s required communications and logging. | Named as a control to place in front of a PLC when remote access is required; no comparative performance is stated. CISA advisory, revised December 18, 2024. |
| VPN | Where the VPN terminates, what network it permits access to, and how authentication and activity are controlled. | Named as one possible control in front of a PLC for required remote access; no implementation details or ranking are stated. CISA advisory, revised December 18, 2024. |
| DMZ or bastion host | Which users and systems can reach it, what onward access it permits, and how logins are authenticated and recorded. | Recommended as an OT-boundary pattern for HMI security, alongside MFA, IP allowlisting, and remote-login logging. CISA and EPA, December 13, 2024. |
| Jump box | Where it resides and how access through it is restricted, authenticated, and logged. | Named among possible controls or patterns; the cited guidance does not provide a comparative ranking. EPA and CISA, September 2024. |
These are evaluation questions, not a source-backed ranking. Select and combine controls based on the topology, protocols, remote-access needs, monitoring capability, and operational constraints of the utility.
Implement changes in a controlled sequence
- Inventory and map: record OT and IT assets, exposed PLCs and HMIs, vendors, remote-access paths, and operationally required communications.
- Identify exposure: locate PLCs reachable from the public internet and determine which external connections are necessary.
- Design the boundary: specify where OT and IT are separated, which intermediary controls each crossing, and how allowed activity will be monitored and logged.
- Write least-privilege rules: deny OT connections by default and allow only documented, explicitly needed connections. Avoid rules that grant wider access than the mapped operational purpose requires.
- Protect remote access: place a proxy, gateway, firewall, or VPN in front of a PLC when remote access is required. For HMI access, consider the DMZ or bastion-host pattern and the MFA, IP allowlisting, and login logging recommended by CISA and EPA.
- Validate and document: check that required operational communications still work, confirm that unneeded access is denied, and update the asset inventory, network map, and access rules to reflect the deployed design.
Keep the boundary effective over time
Network maps, asset inventories, and allowed connections can become inaccurate as equipment, vendors, and operational needs change. Review them periodically, verify that each permitted path still has a documented purpose, examine boundary and remote-login logs, and conduct cybersecurity assessments. CISA, EPA, and FBI include inventory and assessments among their water-sector cybersecurity actions; they do not specify a single assessment schedule in the cited action list.
When a new connection is requested, assess its purpose and path before allowing it. Update the documented rule set and monitoring approach if the connection is approved; remove permissions that are no longer required. The central design test remains whether each route into OT is explicit, controlled, and visible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
