The claim that a control system is not on the internet is often untested. CISA's advisories describe internet-reachable PLCs with default passwords, remote access tools at a water plant, and VPN logins in the 2015 Ukraine outages. The first CISA mitigation for OT is to disconnect devices from the public internet and remove unintended exposure.
Myth versus fact
Myth: We are air-gapped, so remote attacks are not a concern.
Fact: The word often describes the design, not the current network. Over years, a modem, a cellular router, a vendor tunnel or a remote control tool gets added. CISA's primary mitigation number one, to remove unintended exposure, exists because it happens.
Myth: Only IT systems get attacked this way.
Fact: The December 2023 advisory describes actors authenticating to internet-connected Unitronics PLCs over a default port, where the devices had default or no passwords. At least 34 of the compromised devices were in water and wastewater.
Myth: Nobody would find our small site.
Fact: The 2023 advisory also describes the campaign hitting at least 75 US devices overall. Scanning does not need to know who you are. The 2021 water plant advisory says the FBI could not confirm that incident was a targeted intrusion.
How to test the claim
- List every connection that crosses your boundary: vendor links, cellular modems, remote control software, cloud dashboards.
- Check what the internet sees. Review your public address ranges and, with permission, use a scan or an assessment. Free options exist for some sectors, such as the EPA program covered in our post on that assessment.
- Walk the site. Look for unlabeled routers and devices with SIM cards.
- Search your logs for inbound connections to control devices.
- Ask vendors which of their products phone home.
What to do if you find exposure
Remove it if no one can justify it. If it must stay, put it behind a controlled entry point with strong authentication, as in our remote access checklist. Change default credentials. Keep a backup of the device configuration before you touch it, and make changes in a planned window.
Keep checking
A single check goes stale. Schedule a recheck each quarter and after every project that touches connectivity. Add new connections to your inventory the day they appear.
Quick check
If we are not exposed today, are we safe?
Not necessarily. Credentials, vendors and IT networks can still provide a path. Segmentation and remote access controls matter even when nothing is directly exposed.
What is the quickest first check?
List all external connections, then confirm each one has an owner, a reason and a strong login.
Safeguard offers a free scan at gold.safeguard.sh/scan for dependency risk in software you build. It does not scan for exposed PLCs.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA et al., AA23-335A
- CISA, AA21-042A
- CISA, IR-ALERT-H-16-056-01
- EPA, Water Sector Cybersecurity Evaluation Program
Last reviewed: 19 October 2026.
