The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →To find cellular modems that may be missing from a water utility’s OT records, compare equipment and service records with physical inspections of remote sites and a logical survey of network connections. A scan alone cannot prove the inventory is complete: a modem installed by a utility, vendor, or integrator may be absent from documentation and routine attack-surface scans. Once found, determine whether its connection is operationally necessary; remove unnecessary internet paths, and formally document and control any route that must remain.
Why a cellular modem can be an overlooked route into OT
Operational technology (OT) monitors or controls physical processes. In a water or wastewater system, relevant assets can include programmable logic controllers (PLCs), remote terminal units (RTUs), SCADA components, communications equipment, and the networks connecting them.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
InHand Networks IR302 Industrial IoT 4G LTE VPN Cellular Router | $178.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
A cellular modem is a communications path, not proof that an attached control device is reachable from the public internet. Exposure depends on configuration, routing, authentication, and the assets on the other end. But a modem that connects a remote tank, lift station, or well to a primary SCADA system can create an internet connection outside the records or scans a utility normally checks. The EPA’s July 2024 guidance specifically calls out wireless and cellular paths when reviewing OT connections to the public internet: EPA Factsheet 2.X.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIn a July 30, 2026 alert, CISA said recent targeting included cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack-surface scans. The same alert reported increased targeting of exposed PLCs in the water and wastewater sector, including cases involving changed passwords, loss of operator access, and PLC disconnection through IP changes. CISA said the activity had led to boil-water notices and sustained manual operations; the alert does not say that every incident involved a cellular modem. Read the CISA alert.
#1 Best Overall
- NEVER GO OFFLINE & ZERO TRUCK ROLLS: Stop paying for expensive on-site technician visits just to reboot a router. The IR302 features an embedded Hardware Watchdog and multi-layer link detection. If the cellular connection drops, the router automatically self-recovers and reconnects for unattended remote sites like EV charging stations, ATMs, smart vending machines, and digital signage
- CERTIFIED FOR MAJOR U.S. CARRIERS & DUAL SIM: Specifically designed for North America (LTE Cat 4 - Model FQ38). It is fully compatible and certified with Verizon, AT&T, and T-Mobile. Equipped with a Dual SIM card slot, it supports seamless Link Failover-if your primary carrier loses signal, it instantly switches to the backup carrier to ensure Always-on connectivity. (Note: SIM cards and data plans are not included)
- ENTERPRISE-GRADE SECURITY & VPN NETWORKING: Protect your critical business data over public cellular networks. The IR302 is equipped with a Stateful Packet Inspection (SPI) firewall, DoS attack defense, and supports comprehensive VPN protocols including OpenVPN, IPsec, WireGuard, and ZeroTier. Easily create secure, encrypted tunnels for remote PLC maintenance or medical equipment diagnostics
- WI-FI, ETHERNET & DIGITAL I/O INTEGRATION: More than just a cellular modem. It features 2x 10/100 Ethernet ports (WAN/LAN switchable), built-in Wi-Fi (802.11 b/g/n) for local wireless access, and with reliable range DC 9-36V power(Included US Power Plug). Unique to this -IO model, it includes 2x Digital I/O (DIO) ports, allowing you to remotely monitor door sensors or trigger physical relays
- RUGGED DESIGN & FREE CLOUD MANAGEMENT: Built for harsh environments with a wide operating temperature of -20C to 70C (-4F to 158F) and DIN-rail mounting. Scale your business effortlessly-connect your router to the InHand Device Manager cloud platform to remotely monitor, configure, and batch-update tens of thousands of distributed routers from a single dashboard
The scale of the sector makes complete visibility a practical challenge, not a reason to guess at exposure. A NIST overview dated October 1, 2026 describes nearly 50,000 community water systems and more than 16,000 wastewater treatment systems in the United States, and says more than 80% of utilities serve 3,300 people or fewer. These are sector-scale figures, not counts of incidents or undocumented modems. The overview also points to NIST SP 1800-45 as a practical secure-remote-access resource for water and wastewater utilities.
How to locate modems and other undocumented connections
Use a reconciliation process: establish what the utility operates, compare the records with the physical environment, then validate the network paths. The joint 2025 asset-inventory guidance recommends combining physical inspection, logical survey, and documentation rather than relying on a single discovery method. Its water-sector taxonomy is a notional example, not an inventory verified at a particular utility site.
1. Map the operational footprint
List the facilities, processes, and remote sites that may communicate with OT. Include water treatment and distribution, wastewater treatment and collection, reuse, data management, communications infrastructure, and remote tanks, lift stations, and wells. Treat this as the scope for discovery, not as a claim that every utility has every asset type.
2. Compare records with what is installed
Review current network diagrams, OT and IT asset lists, vendor and integrator records, and available bills or service records. Then arrange physical checks at facilities and remote sites to identify communications equipment that the records do not show. Pair those inspections with a logical or network survey to establish which assets communicate and how. A scan can help identify devices or paths visible to it; it cannot establish that no unrecorded modem or connection exists.
3. Record enough detail to assign responsibility
For each modem and connected OT asset, capture the facts needed to locate, understand, and manage the route:
- Asset role and type, including whether it is a modem, PLC, RTU, or other component.
- Physical location, manufacturer and model, and the department or person responsible for it.
- IP address and network context, the primary communications method, and known network dependencies.
- Ports and services where practical, prioritizing assets that communicate beyond the OT perimeter or over wide-area networks.
- Vendor or integrator involvement, the operational purpose of the connection, and the date the record was reviewed.
The joint guidance notes that collecting ports and services can take time, so utilities can prioritize those attributes for assets with external or wide-area communications first. See Foundations for OT Cybersecurity: Asset Inventory Guidance for the inventory process and attributes.
4. Validate who owns the connection
Ask operations, OT/IT security staff, vendors, and integrators to confirm each route’s purpose and maintenance responsibility. If a modem appears at a site but nobody can identify its owner or operational function, keep it visible as an unresolved asset while the utility establishes whether it supports a live process. Do not infer that a connection is unnecessary merely because it is missing from a diagram.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide whether each internet path should remain
EPA’s July 2024 guidance says utilities should know which SCADA or OT assets are internet-connected and remove the connection if possible. For an exception, EPA recommends formally justifying the operational need and applying compensating controls. The checklist is voluntary guidance, not a legal requirement that applies identically to every system; other obligations depend on the utility’s jurisdiction and circumstances.
| Connection approach | What to establish | How to treat it |
|---|---|---|
| Unneeded internet connection | No operational requirement has been identified. | Plan removal with the people responsible for operations and safety, then update the inventory and connection records. |
| Operationally required cellular path | Document the process need, owner, connected assets, and network route. | Use a telecom-provider private network whenever possible, as EPA advises, and apply appropriate access controls. A private network does not remove the need to document and manage the connection. |
| Remote access to OT | Identify who needs access, to which systems, and for what purpose. | Mediate access through a VPN or gateway rather than connecting directly to a PLC; apply identity, firewall, logging, password, and source-address controls appropriate to the system. |
The comparison reflects the distinct decisions a utility must make: whether a route is needed, how exposed it is, whether its owner and network path are known, and whether recovery is ready if access changes. It is a practical synthesis of EPA, CISA, and joint inventory guidance, not a separate agency framework.
Control remote access that must remain
For internet-connected OT that cannot be removed, EPA recommends documenting the operational justification and compensating controls, including multifactor authentication (MFA), firewalls, and centralized logging. EPA’s revised August 2024 water-sector guidance also recommends MFA for remote OT access and regular backups with testing. CISA advises using a VPN or gateway for remote OT access instead of connecting directly to a PLC; it also recommends password protection, changing default passwords, and allowlisting known source IP addresses. Apply controls in a way that fits the equipment and operational requirements, and verify how they affect authorized maintenance and emergency procedures.
For a cellular route, confirm with the service provider and the utility’s network personnel how traffic is routed and which systems can reach the connection. Do not assume that using cellular service alone means the modem is private, isolated, or publicly reachable; verify the actual configuration and path. The cited guidance does not establish that every cellular modem is exposed or vulnerable.
Remove exposure without creating an operational outage
Do not disconnect a modem or control device solely because it is unfamiliar. First coordinate with operations and the responsible system owner to understand the process dependency and consequences of losing communications. Schedule changes under the utility’s operational and safety procedures, confirm an alternate means of monitoring or control where needed, and update the inventory and diagrams after the change.
If an exposed PLC is disconnected, CISA advises retaining a known-clean PLC image backup. EPA’s August 2024 guidance recommends regular backups and testing, so the utility should know that its recovery materials are usable rather than merely present. The EPA cybersecurity guidance includes inventory review and backup practices.
Keep the inventory current
Inventory is an ongoing operating process, not a one-time scan. Assign responsibility for updates when a site, modem, vendor, network route, or remote-access arrangement changes. EPA’s revised August 2024 guidance says to review the OT/IT asset list at least quarterly and to include legacy and third-party equipment. That recurring review helps surface equipment that may have been installed or changed outside the utility’s usual documentation workflow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
