jain.com — data centers, connectivity and security, analyzed daily

Tag: SCADA

  • NIST’s 3 Water Blueprints Show AI Cooling’s Cyber Risk Starts at Utility Remote Access

    NIST’s 3 Water Blueprints Show AI Cooling’s Cyber Risk Starts at Utility Remote Access

    TL;DR · 30-second read

    The Short Version

    A US government standards agency has published a guide telling water and sewer utilities that their riskiest weak spot is remote access: the ways staff and outside contractors log in from elsewhere to run pumps and treatment equipment.

    More than half of American water systems serve 500 people or fewer and have few staff to defend them.

    This matters beyond your tap. Many of the giant computer buildings behind artificial intelligence use water to keep their machines cool, often supplied by those same local utilities.

    The US National Institute of Standards and Technology (NIST) has published SP 1800-45, Cybersecurity for the Water and Wastewater Sector: Build Architecture, which identifies secure remote access as the immediate cybersecurity priority for water and wastewater utilities, Industrial Cyber reported on June 26. The project, run by NIST’s National Cybersecurity Center of Excellence (NCCoE), offers high-level reference architectures and three example implementations built from commercially available products.

    The three designs cover a traditional on-premises gateway (demonstrated with TDI ConsoleWorks), a cloud-managed access model (StrongDM with Cisco Duo), and encrypted machine-to-machine links between remote sites (Q-Net Security hardware). NIST describes them as product-agnostic demonstrations of capability, not vendor endorsements.

    Executive Summary

    NIST’s new practice guide gives water utilities a concrete starting point for what it calls the most pressing gap in their operational technology (OT), the networks of controllers and sensors that physically run pumps, valves and treatment processes. Utilities have moved from manual, on-site operation to automated and remotely managed systems. That shift improved efficiency but opened two-way paths into equipment that, if misused, could let an attacker manipulate processes or create unsafe conditions.

    The guidance matters to the data center industry because water is an upstream dependency for many facilities that use water-based cooling. A data center can harden its own networks and still depend on a municipal control system it neither owns nor sees into. NIST’s focus on remote access marks where that external dependency is most exposed, and its emphasis on staffing and funding signals that many utilities will struggle to close the gap quickly.

    The guide is also a snapshot of a market decision facing thousands of utilities: build remote-access security in-house, rent it from a cloud provider, or encrypt the links between sites in hardware. Each choice moves risk to a different place, and at least one vendor is already arguing that none of these designs goes far enough.

    Why a Water Security Guide Is a Data Center Story

    A water-cooled data center, especially one that relies on evaporative cooling towers, depends on a steady supply of water at usable pressure and quality. That supply is managed by the local utility’s SCADA (supervisory control and data acquisition) system: servers, programmable logic controllers (PLCs, the small industrial computers that switch pumps and valves) and operator screens spread across a main control station, regional centers and remote pump stations. NIST’s point is that these pieces are held together by remote access, both people logging in from outside and machines at separate pumping stations talking to each other over telecom networks. The guide warns that enabling two-way remote access to operational or safety systems widens the attack surface and could allow malicious actors to manipulate processes or create unsafe conditions.

    Follow that chain downstream and the conclusion in our headline follows. For a facility whose cooling depends on municipal water, the earliest point at which a cyber incident could reach its cooling is not its own chiller plant. It is the utility’s remote-access layer: the vendor login to an operator screen, the cloud-brokered session, or the unencrypted controller traffic between pump stations. NIST’s three blueprints map directly onto those three entry points, which is why they read as a map of inherited risk for anyone siting or operating water-cooled capacity.

    The exposure is uneven. Facilities using air cooling or closed-loop liquid systems draw far less from the municipal supply than those running evaporative towers, and any disruption at a utility would hit hospitals, homes and industry first and just as hard. The practical point is narrower and more useful: for water-dependent sites, the utility’s cyber posture belongs in site selection, resilience planning and supply conversations, alongside drought risk and capacity allocation.

    Utility Size Decides Which Blueprint Is Realistic

    NIST’s own figures show why no single design fits the sector. Very small community water systems, serving between 25 and 500 people, make up more than half of all systems but serve a small fraction of the population. Fewer than 1 percent of utilities are classified as very large, serving more than 100,000 people, yet they supply nearly half of the US population. Larger utilities tend to run dispersed infrastructure with complex SCADA networks and dedicated IT and OT staff. Smaller ones often rely on simpler or fully manual systems, aging hardware, few staff and tight budgets.

    That split drives the choice of architecture. NIST expects larger systems to support in-house deployments, while smaller utilities are likelier to lean on vendor-managed or cloud-based remote access. The consequence is that for a large share of the country’s water systems, security will rest heavily on the terms of a service contract. NIST explicitly warns utilities to check those contracts for encryption, access controls, intrusion detection and vulnerability management. The guide also stresses that adequate staffing and funding are essential to configure and maintain any of these environments, a quiet acknowledgment that the architecture is the easy part.

    Three Architectures, Three Places to Put the Risk

    The first design is the classic industrial pattern: a demilitarized zone (DMZ, a buffer network between the outside world and the control system) guarded by paired firewalls, with a remote access server inside it. Users authenticate with multi-factor authentication over HTTPS, role-based rules limit which SCADA consoles, operator screens and PLCs they can reach, and every session is logged. NIST demonstrated it with TDI ConsoleWorks. It offers the utility the most control and demands the most in-house skill.

    The second moves authentication, authorization and session monitoring to cloud-managed infrastructure. Users sign in with multi-factor authentication, receive an access token, and a security gateway inside the operational network checks that token before allowing a connection. NIST demonstrated this with StrongDM and Cisco Duo. It lowers the management burden, which is why NIST pitches it at smaller utilities, but it shifts part of the trust to the provider.

    The third addresses traffic that no person touches: PLCs and remote terminal units exchanging process data between sites. Here NIST recommends encryption appliances at each network edge that authenticate one another and encrypt data before it leaves. The demonstration used Q-Net Security’s Q-Box hardware to protect Modbus traffic between PLCs. Modbus is a long-established industrial protocol that was not designed with built-in encryption, so this design closes a gap that access controls on human users do not address.

    The Hardware-Isolation Critique, Weighed Fairly

    Mike Carr, field CTO of Xona Systems, agreed that remote access is the water sector’s biggest cybersecurity weakness, but argued that the named products are all software sitting on the same attack surface adversaries already exploit. He called for hardware-enforced protocol isolation that physically separates the user from the critical network, summarised as “You can’t hack what you can’t reach.”

    The critique makes a real point: remote-access gateways are themselves internet-facing targets, and adding controls to an exposed path is not the same as removing the path. Several parts of the claim need testing against the guide itself, though. The third implementation is hardware-based. NIST presents all three as product-agnostic examples rather than recommended products. And NIST treats remote diagnostics and vendor maintenance as operational necessities, while noting that some utilities already choose one-way alarming or on-site work for sensitive tasks. The statement that attacks are seen “in the field every day” comes without incident data. Utilities weighing the argument should ask any vendor, including this one, for evidence that its model preserves the maintenance access they actually need.

    Background

    NIST, part of the US Department of Commerce, publishes widely used cybersecurity frameworks and guidance. Its National Cybersecurity Center of Excellence produces the SP 1800 series of practice guides, which show how commercially available products can be combined to solve specific security problems in a given sector. SP 1800-45 applies that approach to water and wastewater utilities, a critical infrastructure sector made up of thousands of systems that range from tiny rural operators to large metropolitan authorities.

    For the data center industry, water has become a central siting and operating issue as capacity grows for AI and cloud workloads. Facilities that cool with water depend on the reliability of local utilities, which puts utility resilience, including the cybersecurity of utility control systems, alongside power availability and land in data center planning.

    Sources

    Source: NIST SP 1800-45 outlines remote access security as key priority for water, wastewater sector amid expanding OT cyber risks (Industrial Cyber): coverage of NIST’s practice guide on securing remote access to water and wastewater operational technology.

  • Iran-Linked Actor Claims Breach of California Water Utility: What Is Verified?

    Iran-Linked Actor Claims Breach of California Water Utility: What Is Verified?

    A California water utility is investigating a claim by an Iran-linked threat actor that it breached the utility’s systems, according to a June 17, 2026 report from Cybersecurity Dive. As of the report, the intrusion is a claim under investigation — not a confirmed compromise — and the utility has not publicly validated the actor’s assertions.

    Executive Summary

    The report is short on confirmed detail but long on significance: a threat actor publicly associated with Iran has asserted that it compromised a water utility in California, and the utility has opened an inquiry into whether the claim is real. In critical-infrastructure security, that sequence — public breach claim first, verification later — has become a recurring pattern, and it matters regardless of how the investigation resolves.

    Water and wastewater systems sit at the intersection of two uncomfortable facts. They are unambiguously critical infrastructure — a service failure has immediate public-health consequences — and they are, as a sector, among the least-resourced operators of industrial control technology in the United States. That combination makes them attractive targets for state-aligned actors seeking psychological and political impact, whether or not a given claim reflects a genuine operational compromise. For operators of data centers, networks, and other critical facilities, the episode is a reminder that adversary messaging is itself part of the attack, and that the ability to rapidly verify or refute a breach claim is now an operational capability in its own right.

    A Claim Is Not a Breach — and That Distinction Is the Story

    Everything public in this report hinges on the word “probes.” The utility is investigating; it has not confirmed an intrusion, and the actor’s assertion stands unverified. That matters because state-aligned and hacktivist-branded groups have a documented history of exaggerating, recycling, or fabricating claims against high-visibility targets. Publicly claiming a water-system breach generates headlines and anxiety at essentially zero cost to the attacker, whether or not any system was touched.

    At the same time, dismissing such claims outright would be equally unwarranted. Iranian-affiliated actors have previously carried out real, confirmed intrusions against U.S. water utilities — most visibly the late-2023 wave of attacks on internet-exposed Unitronics programmable logic controllers, which defaced operator screens at multiple utilities and prompted advisories from CISA and the water sector’s information-sharing bodies. The honest posture, for readers and for the utility itself, is disciplined agnosticism: treat the claim as unproven, investigate as if it could be true, and communicate what is and is not known.

    Why Water Utilities Keep Appearing in the Crosshairs

    Water systems run on operational technology, or OT — the industrial controllers, sensors, and SCADA (supervisory control and data acquisition) software that open valves, run pumps, and dose chemicals. Much of this equipment was designed decades ago for reliability, not for exposure to a hostile internet, and many of the roughly 50,000 community water systems in the U.S. are small operations without dedicated cybersecurity staff. Remote-access tools bolted on for operator convenience, default credentials, and flat networks between office IT and plant floors are recurring findings across the sector.

    For a state-aligned actor, this asymmetry is the appeal. Even a shallow intrusion — a defaced control screen, exfiltrated documents, a screenshot of an operator interface — can be presented as evidence of reach into an adversary nation’s drinking water, with psychological effect far exceeding the technical sophistication involved. The attacker’s goal is often the announcement as much as the access. That is why federal agencies have repeatedly urged water utilities to remove control systems from the public internet, enforce multifactor authentication, and change default passwords: measures that are basic, but that close precisely the doors these campaigns walk through.

    The Verification Problem Is Now an Operational Cost

    When a breach claim surfaces publicly, the target inherits an urgent, expensive burden: prove or disprove it, fast, under public scrutiny. That requires log retention deep enough to reconstruct weeks or months of access, asset inventories accurate enough to know what “our systems” even means, and forensic readiness in OT environments where taking a controller offline for imaging can interrupt service. Utilities that lack these capabilities face prolonged uncertainty — and prolonged uncertainty, not the intrusion itself, often does the most reputational damage.

    There is a broader lesson here for every critical-infrastructure operator, including the data-center and connectivity industry. Incident response planning has traditionally started at detection; it increasingly needs to start at allegation. The ability to say, credibly and quickly, “we have investigated and here is what we found” depends on investments made long before any claim appears — monitoring of OT networks, segmentation between IT and control systems, and rehearsed communication plans. Those investments are unglamorous, but this episode shows exactly when they pay off.

    Background

    The U.S. water sector comprises tens of thousands of mostly small, locally governed utilities, and it has repeatedly been flagged by federal agencies as a cybersecurity soft spot among the sixteen designated critical-infrastructure sectors. Unlike bulk electric power, water has no binding federal cybersecurity standards regime of comparable reach, leaving practices uneven across systems of very different sizes and budgets. Iranian-affiliated threat activity against the sector is not hypothetical: the 2023 compromises of Unitronics control devices at several U.S. utilities — carried out by actors the U.S. government linked to Iran’s Islamic Revolutionary Guard Corps — demonstrated that opportunistic attacks on exposed water-system equipment do occur, and prompted sector-wide advisories on securing internet-facing controllers. Against that history, public breach claims aimed at water utilities land on well-prepared soil, which is precisely why each new claim demands careful verification rather than reflexive acceptance or dismissal.

    Source: California water utility probes breach claim by Iran-linked actor — Cybersecurity Dive report, June 17, 2026, on a California water utility’s investigation of an unverified breach claim by an Iran-linked threat actor.