Cities, towns and special districts

Our water plant has SCADA on the network. Do you touch that, or does our engineer?

Short answerYour integrator and engineer own the control system. We own the business network and, more importantly, the boundary between the two, because that boundary is where the risk actually sits.

A clear line, because getting this wrong is expensive in both directions.

Not us. Programming PLCs, changing control logic, tuning setpoints, anything that affects how the plant actually runs. That belongs to your controls integrator and your engineer of record, and an IT company that offers to get in there is a risk to you.

Us. The business network, the office side, and the connection between the office network and the control network. That connection is where nearly every real incident at a small utility has come from.

A water plant in Pinellas County made national news in 2021 over remote access to its control system. Whatever the eventual conclusion about cause, the lessons that came out of it were not exotic: shared remote access credentials, flat networks with no separation between office and control systems, and remote access tools nobody was monitoring. Those are the same findings that come up at small utilities over and over.

What we look at, and what you can ask your current provider right now:

  • Is the control network actually separated from the office network, or is it one flat network with everything able to reach everything? Separated means a firewall with rules, not just a different switch.
  • Who has remote access to the control system, by name? Individual accounts with multi-factor authentication, or one shared login that the integrator, two former employees and a contractor all know.
  • Are there vendor accounts nobody has reviewed in years? Integrators need access. They do not need permanent unmonitored access, and support contracts end without anyone removing the account.
  • Is anything watching that boundary at all? Most of the time, no.

We work with your integrator rather than around them. The usual arrangement: they keep full control of the process side, we provide the segmented network and managed remote access they connect through, and both of us know what the other is doing. That works well and it is much safer than either of us pretending to cover the whole thing.