Water treatment plants and utilities use network connections to monitor and manage equipment spread across large service areas: wells, tanks, pumps, lift stations and treatment sites. That operational need does not mean a programmable logic controller (PLC) or operator interface should be directly reachable from the public internet. The distinction is between controlled connectivity for operations and unnecessary public exposure.
Why water utilities need connected systems
Water infrastructure is distributed. Equipment may sit far from a central treatment plant, and operators need to know its status and respond to changing conditions. Supervisory control and data acquisition (SCADA) systems help provide a central view of processes across sites; connected monitoring can also support analysis of operations and water quality. NIST describes these capabilities in its Cybersecurity for the Water and Wastewater Sector project.
As an Amazon Associate I earn from qualifying purchases.
Remote connections can also support maintenance by utility staff or system integrators. Without remote visibility, staff may have to travel to a site simply to inspect its operating status. The sources describe this operational rationale but do not quantify travel, labor or cost savings.
How the components fit together
- PLC: A controller that operates equipment or processes according to its programmed logic.
- HMI: A human-machine interface—typically a screen or software interface operators use to view conditions and make authorized changes.
- SCADA: A supervisory system that collects information from and helps operators oversee equipment across sites. It may communicate with PLCs and present information through HMIs.
These terms describe related parts of an operational system, not interchangeable devices. Risk depends on how the parts are connected and protected, not simply on whether a utility uses SCADA.
#1 Best Overall
- User-friendly NAT functionality simplifies network integration
- Hands-free network access control through automatic whitelisting of locally connected devices
- Integrated security features to ensure device and network safety
- Ultra-compact size and robust industrial design suitable for cabinet installation
- Supports secure boot for checking system integrity
“Connected to the internet” can mean different things
A utility connection might run over a private carrier network, pass through a firewall and segmented network, or provide remote access through a controlled gateway. Those arrangements differ from putting an HMI or PLC on a publicly reachable address. EPA specifically cautions utilities to account for cellular modems, which can create overlooked routes into remote equipment, and recommends private telecom networks where possible.
EPA’s 2024 guidance puts the default plainly: “Eliminate OT asset connections to the public Internet unless explicitly required for operations.” If a connection is operationally necessary, its purpose should be documented and safeguards selected with the people responsible for the operational technology (OT). CISA likewise says remote access should go through a VPN or gateway rather than directly to a PLC.
Rank #2
- Great Variety of Sizes: 32 Pcs of the most commonly used 15 sizes assorted rubber grommet assortment kit.With retractable box cutter and velcro straps
- High Quality: Rubber washers are made of flexible and durable rubber material, they are of good electric resistance capability.
- Easy To Use: Wire grommets are quicker and easier to install since they can be placed on one side only.
- Wide Range of Applications: Very useful for auto and other projects where wiring cable needs to be run through metal or plastic openings.
- Packaging Includes:2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs)(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),13/16''Drill Hole(2 Pcs).With retractable box cutter and velcro straps
There is no representative sector-wide figure in the cited agency material establishing what share of water plants are connected in each way or directly exposed. It would be inaccurate to assume every plant has the same architecture—or that every connected system is publicly accessible.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy direct exposure is a serious risk
An exposed HMI can reveal operational information such as system maps, event logs and security settings. If access is not properly protected, an unauthorized person may also be able to change settings or disrupt operations. In a joint fact sheet dated December 13, 2024, EPA and CISA described 2024 incidents in which pro-Russia hacktivists altered pump and blower set points, disabled alarms and changed passwords; affected utilities returned to manual operation.
In a July 30, 2026 advisory, CISA reported increased targeting of water-sector PLCs. The advisory described attackers changing passwords to lock out operators and changing PLC IP addresses; the reported activity led to boil-water notices and sustained manual operations. It also warned that overlooked cellular modems may contribute to exposure. These are dated reports of incidents and targeting, not evidence of how common attacks are across all utilities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How utilities can reduce exposure while preserving necessary access
EPA, CISA and NIST guidance favors reducing unnecessary public exposure first, then protecting connections that operations genuinely require. Controls should be planned with the utility’s OT owner and a qualified system integrator: a change made without operational context can itself interrupt essential service.
Rank #4
- MOXA EDR-810-2GSFP Industrial Secure Router Switch with 8 10/100BaseT(X) ports, 2 1000BaseSFP slots, 1 WAN, Firewall/NAT, -10to60C -- NO VPN --
- Inventory every route in. Identify internet-facing devices and connections, including cellular modems, wireless links, vendor-installed equipment and remote sites. Do not assume routine network scans found every path.
- Remove unnecessary public reachability. Disconnect exposed HMIs and other accessible, unprotected systems where possible. For OT connections that must remain, document the operational need and assign an owner responsible for the connection.
- Use an intermediary for remote access. Route authorized connections through a VPN or gateway rather than directly to a PLC. A segmented network, DMZ or bastion host can help separate the operational environment from external access.
- Control who can connect. Use multifactor authentication (MFA), strong non-default credentials and, where appropriate, allowlists that limit access to known IP addresses. Change default passwords.
- Maintain and monitor the environment. Keep software patched where operationally feasible, record remote logins, and review logs for unusual access times or repeated failed attempts.
- Prepare a recovery path. Keep known-clean backups of PLC images so operators can restore configurations if credentials or settings are changed.
- Get support where needed. CISA offers a free cyber vulnerability scanning service, and utilities can seek help from a qualified system integrator for assessment and secure remote-access design.
CISA’s June 4, 2025 Internet Exposure Reduction Guidance recommends assessing exposure, deciding which assets truly need internet access, protecting any necessary exposed services and reviewing exposure routinely. For water systems, the practical question is not simply whether a connection exists, but whether it is needed, how it is reached, who is allowed through, and whether the utility can detect and recover from unauthorized changes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
- 8+2G all-in-one firewall/NAT --- NO VPN-------/router/switch
- Build up secure remote access tunnel / Protect critical assets by stateful firewall
- Inspect industrial protocol with PacketGuard technology / Easy network setup with network address translation (NAT)
- RSTP/Turbo Ring redundant protocol enhances network redundancy / -40 to 75°C operating temperature range
- Security features based on IEC 62443 / NERC CIP / Check firewall settings with intelligent SettingCheck feature
Sources and guidance
- EPA and CISA: Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems, December 13, 2024.
- EPA: Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems, 2024.
- CISA: CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs, July 30, 2026.
- NIST SP 1800-45: Cybersecurity for the Water and Wastewater Sector, published June 24, 2026.
- CISA, EPA and FBI: Top Cyber Actions for Securing Water Systems, February 21, 2024.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
