最近の水道事業への攻撃は、OTセキュリティ対策が待ったなしである理由を示している

Recent Water Sector Attacks Show Why OT Security Can’t Wait

Critical infrastructure has quietly become one of the most contested spaces in cybersecurity, and this summer made that hard to ignore. A wave of cyberattacks, widely believed to be linked to Iran, though not formally attributed, hit water utility operational technology across more than a dozen U.S. states. Attackers got into internet-facing programmable logic controllers, the small industrial computers that open valves, run pumps, and hold water pressure steady, and in several cases locked operators out or forced utilities back onto manual control. No drinking water was contaminated, and most disruptions were resolved within hours. But the campaign underscored something the water sector has been warned about for years: operational technology built decades before modern cybersecurity practice existed is now in the crosshairs of nation-state actors.

I sat down with Nick Tausek, Lead Solutions Architect at Swimlane, to talk about why water utilities keep ending up on that list, what it actually takes to close the gap, and where automation fits into an answer a lot of utilities can’t otherwise afford.

Why water utilities keep landing on the target list

“There are a couple of reasons water utilities in particular are such a juicy target for nation-state actors,” Tausek says.

• The first is technical. These systems tend to run older operational technology that predates modern cybersecurity practice. The standard advice security teams give everyone else; multi-factor authentication, strong passwords, network segmentation, least privilege, often doesn’t map cleanly onto old OT hardware.
• The second is economic. A large share of U.S. water utilities operate in rural areas with small budgets. Many assume they’re too small to be worth an adversary’s time. That assumption doesn’t hold. As Tausek puts it, “when a nation-state or a capable cyber adversary is looking for targets, anything connected to the internet is a target.”
• The third reason is impact. Water systems can be compromised quickly and repaired slowly. We all need water, so the impact of not having it becomes an emergency faster than, say, a data breach would.

5 fundamentals for hardening OT that nobody gets to skip

Asked what he’d tell a utility running on a limited budget and older equipment  which, he notes, describes most of the water utilities in the country; Tausek’s explained 5 easy things to do:

1. Segregate OT and IT networks as much as possible, and use jump boxes rather than direct connections to reach OT systems that can’t be upgraded.
2. Never expose OT devices to the public internet. PLCs in particular should not be reachable or accessible from the open internet, full stop.
3. Change default passwords everywhere. It’s a small thing that keeps not happening across the industry.
4. Apply multi-factor authentication and least privilege wherever the equipment allows it.
5. For PLCs specifically: put them behind firewalls and gateways with up-to-date ACLs, use zero-trust network access where possible, review configurations regularly for unauthorized changes, and replace end-of-life equipment when the budget allows.

None of this is exotic advice. The gap isn’t information. It’s execution.

Where hygiene runs out of runway

Here’s the problem: a utility can do everything on that list and still get breached, because segmentation and password hygiene don’t answer the question that actually determines how bad an incident gets; what happens in the first hour after you find out.

That’s usually a documented process with a couple dozen steps: isolate the affected device, decide whether to fail over to a backup, get sign-off from the right people, preserve evidence, and eventually prove to an auditor or regulator that all of it happened correctly. Under normal circumstances, that’s manageable. In the middle of an active incident, with a small and likely overworked team, it’s exactly the kind of process humans start skipping steps in.

The industry has a name for the metric that captures the cost of that gap: dwell time, the interval between when an attacker gets in and when they’re actually removed. The longer that interval runs, the more damage gets done and the harder it becomes to be confident an environment is actually clean; a lot of incidents that look resolved turn out, sometimes a year later, to have never fully closed.

Where an AI-powered SOC is one of the answers

This is where automation earns its place, not as a replacement for segmentation and hygiene, but as one of the ways to close the gap those measures leave open.

• Codified playbooks. A thirty-step isolation-and-failover process gets encoded once and executed the same way every time, instead of depending on whoever happens to be on shift remembering it correctly at 2 a.m.
•  Case management with an audit trail. Approvals, evidence collection, alert investigation, and remediation actions live in one system that can also produce the documentation an auditor or regulator will eventually ask for.
• Audit-tool integration. Rather than generating another pile of pentest findings a small team has no way to act on, an AI-enabled automation layer can interface directly with the tools utilities already run and turn unstructured findings into a prioritized, actionable backlog; the exact problem Tausek says a lot of water utilities face with their legacy technology.
• AI-accelerated investigation. Instead of pivoting manually across a dozen tools to confirm what an alert actually means, AI can pull that context together in minutes and confirm, not just assume, that an attacker is fully gone, not just quiet.

The result Tausek points to is measurably lower dwell time and faster time-to-remediation, the two metrics he says would most change how an incident like this plays out for a utility that has them versus one that doesn’t.

What comes next

Tausek doesn’t think this is a water-utility problem in isolation. “Our adversaries are using AI-driven attacks against everything connected to the internet, not just water utilities,” he says. He expects the complexity of these attacks to keep increasing, and organizations that never expected to be targets to keep discovering that they are.  

His closing point is the one worth sitting with:

“It doesn’t really matter whether you’re IT or OT; you’re going to become a target of a geopolitical actor if you’re plugged into the internet. The question is whether you’ll know it, and whether you’ll be able to do anything about it.”

This summer’s water utility attacks are a preview of a pattern that’s going to keep showing up everywhere something is plugged into the internet. The organizations that come out of the next one fastest will be the ones that already know it happened and already have a system ready to act on it.

Frequently Asked Questions about OT Security

Was drinking water contaminated in the water utility cyberattacks?

No. In the wave of attacks that hit water utility control systems across more than a dozen U.S. states this summer, no drinking water was contaminated, and most disruptions were resolved within hours. Attackers gained access to internet-facing programmable logic controllers (PLCs) and, in several cases, locked operators out of controls or forced utilities onto manual operation, but the water supply itself stayed safe.

What is a PLC, and why do attackers target it?

A programmable logic controller (PLC) is a small industrial computer that runs the physical processes inside a water treatment plant: opening valves, running pumps, and holding water pressure steady. PLCs draw attackers because many are internet-facing, run on operational technology built before modern cybersecurity practice existed, and hand an attacker direct control over physical infrastructure once compromised.

Why are water utilities frequent targets for nation-state cyberattacks?

Water utilities are targeted for three reasons, according to Nick Tausek, Lead Solutions Architect at Swimlane. Their operational technology predates modern cybersecurity practice. Many utilities assume their small, rural budgets make them not worth attacking, an assumption nation-state actors don’t share. And water systems can be compromised quickly but repaired slowly, so the impact turns into an emergency fast.

What is OT security, and how is it different from IT security?

OT (operational technology) security protects the systems that run physical processes, such as pumps, valves, and industrial controllers, while IT security protects computers, networks, and data. OT hardware is often decades old and wasn’t built with cybersecurity in mind, so standard IT practices like MFA and least privilege don’t always apply directly and have to be adapted to what the equipment can support.

How can water utilities harden their OT systems against attacks?

Tausek outlines five steps that don’t require a large budget. Segregate OT and IT networks and use jump boxes instead of direct connections. Never expose OT devices, especially PLCs, to the public internet. Change default passwords. Apply multi-factor authentication and least privilege wherever the equipment allows. And for PLCs specifically, use firewalls, gateways, zero-trust network access, regular configuration reviews, and replace end-of-life equipment when possible.

What is dwell time, and why does it matter in OT security incidents?

Dwell time is the interval between when an attacker gets into a system and when they’re actually removed. The longer that interval runs, the more damage an attacker can do, and the harder it becomes to be confident the environment is actually clean. Some incidents that appear resolved turn out, sometimes a year later, to have never fully closed.

What is an AI-powered SOC, and how does it help close the OT security gap?

An AI-powered SOC (security operations center) codifies incident response playbooks, manages cases with a built-in audit trail, integrates with the audit tools a utility already runs, and uses AI to investigate alerts and confirm remediation. Swimlane points to lower dwell time and faster time-to-remediation as the measurable results, closing the gap that network segmentation and password hygiene alone leave open.

Is this only a problem for water utilities, or does it affect other industries?

It affects any organization connected to the internet. As Tausek puts it, “it doesn’t really matter whether you’re IT or OT; you’re going to become a target of a geopolitical actor if you’re plugged into the internet.” He expects AI-driven attacks to keep increasing in complexity across every sector, not just water utilities.