Is Your PLC Securely Coded?

Computer technologies have drastically changed how water utilities deliver safe drinking water to the public. Treatment plants that once required several operators on-site to manually control all processes in the field are now fully automated with a single operator monitoring and controlling all processes from a central workstation. Today, remote access configurations allow operators to remotely control and monitor treatment processes from a tablet or smartphone. Programmable logic controllers (PLCs) have removed the need for hard-wired relay logic systems by replacing them with configurable software logic. In addition, constant pressure from stakeholders to do more with less has created a reliance on networking and the technologies that make it possible. The water sector has experienced a convergence of information technology (IT) and operational technology (OT) that has facilitated the use of advanced technologies. This convergence has introduced security risks within these networks that could potentially expose the personal data of individuals, companies, and even government agencies to bad actors. Although the worlds of IT and OT have mitigated security risks using various security hardware and best practices (e.g., implementing firewalls, network segmentation), there is still much room to improve the resilience of these critical systems.