Stocks● Neutral
Forrester: Exposed OT Systems Still Plague Water Utilities
Recent attacks on US water utilities trace back to a decades-old principle: don't put vulnerable systems on reachable networks. Forrester analysts say the lesson remains unlearned.
Continue with
Recent attacks on US water and wastewater facilities trace back to a principle security researchers demonstrated years ago. Connect an unprotected computer directly to the internet and attackers will find it within minutes. That principle applies just as much to operational technology as to traditional IT, Forrester analysts wrote in a blog post.
Many discussions about water-sector cybersecurity focus on budget constraints and staffing shortages. Those are real problems. They are not the primary cause, the analysts said. The more fundamental issue is that organizations continue to expose programmable logic controllers, industrial control systems, and other OT assets to networks attackers can reach.
Services like Shodan continuously scan the internet for exposed devices. What was once manual reconnaissance is now automated. Attackers no longer need to know about a specific utility to find its systems. Visibility itself becomes a risk. Forrester noted that not every attack is driven by ideology or ransom demands. Sometimes attackers compromise a system simply because they can.
Agentic AI adds a new dimension. Organizations are exploring how AI can improve productivity and security. Threat actors are doing the same, using automation to identify exposed assets and gather intelligence. The economics of reconnaissance are shifting in the attacker's favor. Finding exposed systems no longer requires significant effort. Correlating those systems with known weaknesses becomes easier. Building repeatable attack workflows becomes faster. Forrester warned that future threats will increasingly involve automated systems continuously searching for opportunities, not highly skilled adversaries manually targeting individual assets.