Water utilities should first remove unnecessary public internet access to PLCs and HMIs, replace default or weak credentials, and put a controlled access point in front of any device that must be reached remotely. Then restrict network paths, keep an accurate asset and firmware inventory, monitor changes, and test recovery. These are priorities, not a universal menu-by-menu recipe: confirm every change against the specific equipment and process before applying it.
1. Remove unnecessary internet exposure
Start by identifying which PLCs, HMIs, and remote-access devices can be reached from the public internet. Disconnect direct public access where it is not operationally necessary, and close exposed ports and services the system does not require. CISA and partner agencies specifically urge organizations to disconnect internet-facing PLCs from the public internet where possible and eliminate unnecessary exposure in their PLC exploitation advisory.
As an Amazon Associate I earn from qualifying purchases.
For water and wastewater operators, the EPA and CISA also put reducing exposure among their priority practices in 2024 cybersecurity guidance. Do not leave an exposed connection open simply because it is convenient for maintenance. If remote access is genuinely needed, place a managed access control point in front of the PLC rather than exposing the controller itself.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIn the Unitronics Vision incident context, CISA additionally recommended changing the default port and device name. Those are supporting, product-family-specific measures—not substitutes for removing unnecessary exposure or controlling access, and not universal settings to change on every PLC.
#1 Best Overall
- -- PLC Type: Fully compatible with FX1S, 7 Input 5 Relay Output (24V pulse single). Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3/7.0 (Pls contact us, we will share it and the video instruction and guidelines). For HMI model: pls choose FE Serial, 280D
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
2. Replace default credentials and protect management functions
Change default, absent, or weak credentials before commissioning equipment. The CISA advisory describes actors accessing internet-connected Unitronics Vision devices with default or no passwords, making credential hygiene a direct priority rather than a housekeeping task. Use strong, unique credentials for authorized users and protect functions that allow access to controller state, programs, or configuration.
Restrict who can perform management tasks and operating-mode changes. Disable unused authentication methods and features only after confirming they are not needed for safe operation or recovery. CISA’s Unitronics-specific recommendations refer to TCP/IP, project upload, INFO mode, and SD card passwords; those names and controls should not be assumed to exist on other manufacturers’ equipment.
3. Gate and monitor necessary remote access
Where remote support or operations access is required, route it through a proxy, gateway, firewall, or current VPN positioned in front of the PLC. Limit access to approved source systems and authorized users, apply multifactor authentication (MFA) at the OT access boundary where possible, and log remote logins, failed attempts, and configuration changes. CISA notes that a gateway can provide MFA even when the PLC itself cannot.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- Weight: 1.00lb
- Product Dimensions: 9.00 x 9.00 x 7.00 inches
- Condition: New
A firewall or VPN is a boundary, not a complete hardening plan. It does not by itself correct weak accounts, unnecessary services, outdated firmware, or poor monitoring. CISA and EPA’s HMI fact sheet recommends strong passwords and MFA, segmentation, patching, IP allowlisting, and logging remote access.
4. Segment OT traffic and allow only necessary communications
Separate operational technology (OT) from business IT and define controlled conduits between network zones. Use firewalls, gateways, proxies, or an OT demilitarized zone (DMZ) or bastion host to create a deliberate access point. Permit only communications required for the process, and consider allowlisting authorized workstations and other approved sources rather than allowing broad network reachability.
Segmentation limits how far an intruder or mistake can travel; it does not make every permitted connection trustworthy. Document which systems need to communicate, why they need it, and who can approve changes to those paths.
Rank #3
- -- PLC Type: Fully compatible with FX1S, 10 Transistor Input (NPN Type), 7 Relay Output. Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse, built-in 2AD（0-10V) and 2DA(0-10V), also 2 NTC10K B3435 probe. Just read the address of AD DA NTC's will ok, 2 high speed input 100KHz X0 X1 to control encoder
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3 and Choose FE serial 380 model in HMI software. (Pls contact us, we will share it and the video instruction and guidelines), very easy to use, just create the buttun and set the address
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
5. Maintain an inventory and update deliberately
Keep an inventory that identifies PLC and HMI models, engineering workstations and software, firmware versions, network exposure, and support status. Use manufacturer guidance to assess updates and known vulnerabilities, prioritizing issues relevant to the devices and exposure in your environment. The joint water-sector fact sheet highlights asset awareness, vulnerabilities, response, and recovery as core actions.
Recommended Free Tools
Plan updates and configuration changes around operational requirements and suitable maintenance windows. The Unitronics advisory directed affected users to update engineering workstations and device firmware to the then-current versions for those products; those historical instructions are not current version advice for other equipment. Check the manufacturer’s current documentation for the exact model and software in use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Monitor changes and prepare to recover
Watch for unusual logins, unexpected protocols, configuration edits, and management actions that alter operating modes or PLC programs. Preserve logs in a way that makes authorized changes distinguishable from unexpected ones, and ensure someone is responsible for reviewing alerts and investigating anomalies.
Rank #4
- -- PLC Type: Fully compatible with FX1S, 10 Input 7 Relay Output (5V pulse single). Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse; have 2 high speed input 100KHz X0 X1 to control encoder also
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder (Pls dowload from link or contact us, we will share it and the video instruction and guidelines), very easy to use, just create the buttun and set the address
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we shared from link
Back up PLC logic and configurations, then test that they can be restored. Keep backups isolated from network connections that could spread malware. For critical functions, consider cold-standby or replacement hardware so recovery does not depend on sourcing equipment after an incident. CISA’s PLC advisory and water-sector guidance both emphasize backup and recovery planning.
Apply changes safely
Security recommendations do not translate into one safe configuration for every controller or treatment process. An arbitrary port change, disabled feature, or firmware update can disrupt control or complicate recovery if it is incompatible with the equipment or operating design. Before a change:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Document the current configuration and the reason for the change.
- Confirm the device-specific procedure and support status with the manufacturer.
- Coordinate with the responsible OT operators and process-safety personnel.
- Schedule an appropriate maintenance window and preserve a tested rollback or recovery path.
For utilities that lack internal OT security capacity, a cybersecurity assessment can help map exposures, access paths, and recovery needs. Any implementation service or network firewall should be selected for the utility’s architecture, required protocols, support arrangements, and ability to deploy it safely; official guidance does not endorse a particular vendor or product.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
