Municipal OT security guidance
Minnesota water-system cyberattacks reinforce the need for VPN-only remote access
Remote communications are essential to modern water and wastewater operations. When traffic crosses infrastructure the municipality does not control, the connection must protect itself.
A warning for every municipal utility
A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, 2026. State incident-response teams worked with federal, state, local, Tribal, and private-sector partners. Officials reported limited or mitigated effects in communities that disclosed incidents, with no active request for residents to change normal drinking-water use.
Plymouth reported communication outages affecting two water towers and multiple wastewater lift stations while crews continued through manual procedures. The city also said the issue was limited to equipment connected through cellular communications.
That detail does not establish that a cellular carrier was compromised or that cellular technology caused the attack. The initial access method, affected equipment, account, vulnerability, and responsible organization had not been publicly identified.
The BEA standard
Cellular service is transport, not a security boundary
Cellular communications can be reliable and secure for towers, wells, lift stations, pump stations, and other remote facilities. But a modem does not automatically protect the PLC behind it. A private IP address is not encryption, a private carrier network is not a firewall, and a private access-point name does not eliminate the need for authentication and access restrictions.
Protect the path
Use a maintained VPN with strong encryption and authenticated endpoints whenever OT traffic crosses a cellular carrier, internet provider, leased circuit, cloud service, or other external network.
Protect the destination
Terminate the connection at a firewall or secure gateway and permit only the required source, destination, protocol, port, user, device, site, purpose, and access period.
Protect the account
Use individual accounts, strong authentication, multifactor authentication where practical, connection logging, controlled account lifecycle management, and prompt removal of obsolete access.
Protect operations
Segment control and business networks, maintain current firmware and security updates, document the architecture, and preserve tested manual operating procedures.
Treat third-party networks as untrusted
“Untrusted” does not mean the service provider is acting improperly. It means the utility does not control every router, support account, platform, configuration, subcontractor, maintenance process, or security decision along the route. Design as though the path between trusted endpoints could be observed, scanned, interrupted, or misconfigured.
Examples
- Cellular and public internet connections
- Cable, fiber, or DSL internet services
- Third-party leased circuits
- Shared municipal or county networks
- Cloud-managed or vendor remote-access platforms
- Third-party-owned or unmanaged radio networks
Utility-owned radio is different
A properly designed municipal radio network may remain a trusted internal system when the utility owns, programs, maintains, and controls its radios, frequencies, addressing, sites, and permitted participants. It still requires review, segmentation, documentation, and least-privilege access.
Remote viewing is remote access
An operator checking SCADA from home, an engineer troubleshooting a pump, an integrator reviewing PLC logic, and a technician examining an HMI or VFD all represent remote access to critical infrastructure.
Authorized computer → encrypted VPN → municipal firewall → specifically approved internal system
Do not directly expose PLC programming interfaces, HMI web servers, SCADA servers, Remote Desktop, VNC, industrial-router administration, engineering software services, camera interfaces, building controls, or unprotected equipment web interfaces to the public internet.
Site-to-site traffic needs the same protection
A tower reporting to a plant, a lift station sending alarms to SCADA, or a well station exchanging pressure and pump data is also remote access when the path crosses an external network.
Remote PLC network → remote-site firewall → encrypted VPN → central-site firewall → SCADA network
The PLC and HMI remain on a private local network. Authenticated firewalls establish the encrypted tunnel and permit only the specific process traffic required. The provider transports the tunnel; it does not become part of the trusted control system.
Encryption and firewalling perform different jobs
Encryption protects the path
It helps prevent operational data and credentials from being observed or altered while traffic crosses infrastructure outside the utility's control.
The firewall protects the destination
It prevents an encrypted tunnel from becoming a broad bridge into the control network by limiting exactly what the connection may reach.
Federal standards follow the same security principle
Federal agencies routinely send information across commercial internet providers, telecommunications carriers, cloud platforms, and other infrastructure they do not fully own or control. Federal security policy does not treat those third-party networks as the protection boundary. Sensitive traffic must instead be protected using approved cryptography and secure communications methods.
Validated cryptography
FIPS 140-3 establishes security requirements for cryptographic modules operated by federal agencies or on their behalf. The NIST validation program verifies that modules meet the standard.
Protected communications
NIST guidance identifies TLS for protecting approved application and web traffic across the internet. NIST also describes IPsec VPNs as a means to provide confidentiality, integrity, authentication, replay protection, and access control for network-to-network traffic.
Trust-boundary controls
CISA's Trusted Internet Connections guidance reinforces that protections must remain in place when federal systems connect with remote users, cloud services, and external networks. It does not require one technology for every connection, but an outside carrier or cloud provider should not automatically become part of the trusted network.
Field checks for municipal teams
Inventory access
- Who can connect remotely today?
- Which systems can each person reach?
- Are accounts individual and current?
- Can access be disabled immediately?
Review boundaries
- Does every external path terminate at a firewall?
- Are site-to-site links encrypted?
- Are rules limited to required traffic?
- Are OT and business networks segmented?
Verify resilience
- Are connections logged and reviewed?
- Are firmware and VPN software maintained?
- Are configurations and backups documented?
- Can crews operate locally when communications fail?
Manual operation remains essential
Utilities should be prepared to operate when SCADA communications, cellular service, telemetry, or internet access is unavailable. Practice local starting and stopping, independent level and alarm checks, chemical-feed control, manual process recording, cross-site communications, and controlled restoration before an emergency occurs.
How Britton Electronics & Automation can help
BEA designs, supports, and services automation systems for municipal water and wastewater facilities. We can help review remote-access paths, identify internet-exposed equipment, secure cellular-connected sites, configure site-to-site VPNs, review firewall rules, segment networks, restrict vendor access, remove obsolete accounts, assess utility-owned radio networks, document PLC/HMI/SCADA configurations, and develop practical backup, recovery, and manual-operation plans.
The goal is not to eliminate useful connectivity. It is to make every remote connection deliberate, authenticated, encrypted, restricted, logged, maintained, and capable of being disabled without preventing safe operation.
Further guidance: Minnesota Department of Health: Assessing Security of Public Water Systems · CISA: Protecting remotely accessible industrial controllers