Free tools Windows power users keep installed
One-click scans. No signup required.
Treat an internet-exposed water-system PLC as an urgent security issue, but do not blindly power it off: it may be controlling a live treatment or distribution process. Alert the utility’s OT/controls and incident-response leads, assess operational dependencies, then remove direct public access through an approved, process-safe change. Investigate whether anyone used the exposed path and preserve relevant records.
What to do first
Bring the people responsible for operations and control systems into the response immediately. Depending on the facility, that may include the OT/controls lead, incident-response lead, operational supervisor, and system integrator or PLC vendor. If process conditions may be affected, follow the facility’s established operating and emergency procedures.
As an Amazon Associate I earn from qualifying purchases.
Record when and how the exposure was found, the public address and reachable service if known, actions taken, who approved them, and observed system conditions. The agencies’ guidance calls for incident-response planning and consideration of operational impact; it does not establish a universal instruction to unplug every live plant controller.
Identify what is actually reachable
“The PLC is exposed” can describe different situations. Establish whether the internet-facing endpoint is the PLC itself, a human-machine interface (HMI), an engineering workstation, a remote-access gateway or VPN, or a vendor access service. Determine which services are reachable, what network zones the endpoint can reach, and whether remote access was intentionally enabled. Consult current network diagrams and the facility’s asset inventory.
This distinction matters: securing a gateway or vendor connection is not the same change as disconnecting a controller that may be operating the process. EPA and CISA reported 2024 incidents in which malicious actors changed water-system HMI settings, including set points and alarms; some affected operators reverted to manual operation. That is a reason to take the exposure seriously, not proof that a particular exposed system has been accessed.
Should you disconnect the PLC?
Generally, remove direct public-internet reachability where possible. CISA’s joint PLC advisory says, “Disconnect the PLC from the public-facing internet.” Apply that direction through the facility’s process-safety, approval, and change-control procedures. In practice, the goal is to cut off the public route—not to shut down the controller’s power without assessing what the controller does.
Rank #2
- 1 PLC Controller 20 i/o; 12 DC Inputs, 8 Relay Outputs
- PLC Ladder Logic Software
- 1 USB Interface Cable
- Operation 24VDC, Bonus PLC ladder logic Training Course
- For Windows 10, at 32bit
- If the PLC does not need remote access: remove its direct internet exposure and place OT control networks and remote devices behind appropriate network boundaries. Review separation from business networks as part of the change.
- If remote access is necessary: put a controlled gateway, proxy, firewall, and/or VPN in front of the PLC programming interface. Limit access to named users and necessary routes, require strong unique credentials and multifactor authentication where available, and monitor use.
- If immediate disconnection could disrupt operations: have responsible OT personnel assess dependencies and approve the safest containment available. If the endpoint cannot yet be disconnected, constrain who can reach it and establish an access-control boundary rather than leaving it broadly reachable.
A VPN or gateway is not automatically safe: it also needs secure configuration, maintenance, restricted access, and monitoring. Do not rely on factory-default passwords.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Compare the two access paths
| Decision factor | No remote access needed | Remote access needed |
|---|---|---|
| Internet reachability | Remove direct public exposure. | Do not expose the PLC programming interface directly; place a controlled access layer in front of it. |
| Identity and network limits | Restrict unnecessary routes and separate OT assets behind appropriate network boundaries. | Allow named users and only necessary routes; use strong authentication and MFA where available. |
| Monitoring | Retain and review relevant network and security records. | Monitor remote sessions and maintain the gateway or VPN securely. |
| Change considerations | Assess process dependencies before removing access. | Assess process continuity, authorized users, and the access system’s configuration before deployment. |
For either path, make the change in a way that preserves safe process operation and leaves the facility able to restore known-good configurations.
Check for signs of unauthorized access
Activate the facility’s incident-response plan and review available records with personnel who understand the specific PLC and HMI. Preserve useful evidence before rotating credentials or rebuilding systems where feasible. Relevant sources may include network, HMI, PLC, VPN, firewall, and account logs.
Look for unrecognized logins or remote sessions; changes to configuration, ladder logic, set points, alarms, or credentials; operator lockouts; and unexplained process behavior. A lack of obvious signs does not establish that access never occurred. EPA guidance emphasizes collecting and protecting logs, while the joint PLC advisory describes manipulation of settings and operator lockouts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover safely and reduce the chance of a repeat
First validate safe process operation and compare the active PLC logic and configuration with trusted engineering records. Restore only from known-good backups and use the facility’s approved change-control process. Review user and vendor accounts, remote-access paths, firewall rules, and network segmentation. Apply patches or upgrades in line with vendor guidance and testing appropriate to the actual PLC and process; avoid an unreviewed firmware update or logic change during containment.
Maintain accurate OT/IT topology information and separately stored, tested copies of PLC logic, configurations, and engineering records. Keep an inventory of internet-accessible assets, decide which genuinely require public reachability, consider operational dependencies before changing access, and reassess exposure routinely.
What is not established by an exposure alone
Finding a public-facing service does not by itself establish that an attacker accessed it, that the PLC was altered, or that the water process is unsafe. Nor does the available agency material establish a sector-wide count of internet-exposed water-system PLCs. The specific risk and safe containment steps depend on the PLC model, exposed services, network topology, process consequences, support status, and evidence available at the facility.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
