Cybersecurity for Water, Power & Public Utilities
Cybersecurity for Water, Power, and Public Utilities
Segmenting and defending control systems and the business systems that surround them.
Publicly owned utilities run two technology worlds. The control systems that move water, treat wastewater, and distribute power were built for availability and long life, often before anyone considered network security. The business systems that bill customers and manage assets look like ordinary enterprise IT. The risk lives where they touch.
What utility environments look like
- SCADA and control systems at treatment plants, pump stations, and substations, some running unsupported operating systems that cannot be patched
- Remote sites connected by radio, cellular, or leased circuits
- Vendor and integrator remote access, frequently standing and rarely reviewed
- Customer information and billing systems holding payment data under PCI requirements
- Advanced metering infrastructure producing continuous consumption data
- Asset management, work order, and GIS systems shared with public works
Where HQT helps
- Asset inventory of what is actually on the control network, including devices nobody documented
- Segmentation between control networks, business networks, and the internet, designed with operations staff rather than imposed on them
- Controlled vendor remote access with multi-factor authentication, session logging, and time limits, replacing standing connections
- Passive monitoring that detects new devices and abnormal traffic without disrupting control traffic
- Configuration backup and recovery for controllers and engineering workstations
- Incident response plans that include manual operating procedures, and tabletop exercises with plant operators
How an engagement usually starts
Usually with an assessment after a board or a regulator asks how the utility would handle an incident, or when a capital project adds connectivity that did not exist before. We are explicit about what is IT work and what requires the control system integrator, and we do not make changes to operating technology without the operations team leading.