Water supply systems face growing cyber threats as networks expand

Full text

Cybersecurity risks in water infrastructure have consequences that reach far beyond systems and networks.

Across the sector, the systems responsible for treatment and distribution are becoming more connected. Pumps, sensors and control environments that once operated in isolation are now linked to wider networks, often in the name of efficiency or modernization.

The problem is that these systems were never built with continuous exposure to cyber threats in mind and connecting them has introduced new attack surfaces that are difficult to maintain visibility of and control.

At the same time, many facilities have crept towards an increasingly blurred line between IT and operational technology (OT). Driven by incremental needs and very practical limits on systemic refresh, these systems have been added to and grown more complex over time rather than being designed securely from the ground up.

As a result, they become more tightly interconnected, with access stretching further across networks and systems than it should. Once an attacker breaches a system, it becomes far easier to move laterally across the network and get closer to critical infrastructure.

Meanwhile, cyber threats continue to encroach on the water sector, with attacks becoming increasingly frequent and their potential impact is hard to ignore. Disruptions to drinking water treatment or control systems can quickly escalate, interrupting supply or affecting water quality and, in turn, the communities that depend on them.

Structural challenges in securing water systems

Securing water infrastructure is made more difficult by the operational realities many providers face. Technology environments have expanded over time, often without dedicated cybersecurity resources growing at the same pace, making it harder to maintain consistent oversight across increasingly ageing and disparate systems.

Many organizations are also balancing modern hyper-connected digital management expectations with the ongoing operation of originally isolated, long-established systems. This places additional pressure on teams responsible for maintaining both resilience and day-to-day continuity.

Another persistent challenge is the divide between IT and operational technology (OT) teams. Because these environments have traditionally evolved separately, with different design approaches, responsibilities, priorities and expertise, they are not always closely aligned, which can slow decision-making and create gaps in visibility during an incident.

In smaller providers, cybersecurity responsibilities may sit with operational staff whose primary expertise lies in running facilities rather than managing cyber risk. Larger organizations may have more specialized cyber teams, but greater separation between functions still introduces coordination challenges and the risk of operational blind spots.

Connectivity without constraint

The growing use of cloud computing platforms and remote access tools has brought clear operational advantages to critical infrastructure like water systems. However, it has also reinforced a default position of keeping systems online at all times, often without a genuine operational imperative for continuous connectivity.

This “always-connected” approach can unnecessarily increase exposure, particularly as more assets become reachable across wider networks. Without clear control over the time windows when systems need to be accessible, organizations may be creating more risk than expected, certainly more than is required.

A stronger, resilient approach starts with recognizing that security grows by making connectivity intentional. Not every system needs to remain online continuously, and limiting unnecessary access significantly improves security outcomes.

This can be achieved by creating stronger separation between critical systems and the wider network, using controls that allow connections to be enabled only when required while maintaining essential operations. In this model, connectivity is actively managed to define resilience on demand.

Containment as a first line of defense

In the event of a vulnerability or compromise, response speed is critical, notably in environments where interconnected systems enable threats to spread rapidly across the network. Without effective connection controls in place, attackers can exploit this unconstrained accessibility to extend their reach before a full response is underway.

The ability to isolate systems in real time helps change this state. Segmenting critical parts of the network helps limit lateral movement, and deeply segmenting down to high criticality digital elements enables organizations to contain threats far more substantially and focus their efforts on speeding up the incident response.

Having this level of control helps limit the spread of disruption and supports a more structured response. It also creates clear, demonstrable evidence of how risk is being managed - something that’s becoming increasingly important as regulatory scrutiny and cyber insurance requirements become more demanding.

Moving to controlled access

The most resilient model possible with physical connection control treats access to critical systems as fully conditional. Rather than keeping them permanently online, connections can be limited to where, when and why they are required for business reasons. As risk levels change, this can be refined or tightened at will.

This lowers both risk and potential impact, minimizing loss, while preserving the flexibility required for day-to-day operations.

For water providers, deliberately managing connectivity and segmenting networks at an infrastructure level should be a priority for resilience. Clearer boundaries and reduced unnecessary access make it easier to protect infrastructure that plays a vital role in public safety.

We've reviewed, rated, and ranked the best ransomware protection software .

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit