Security for Water and Sanitation: protecting SCADA from treatment to supply

Why sanitation is a high-value target with low tolerance for failure

Basic sanitation is, at the same time, an essential public health service and a complex industrial operation. A water and wastewater utility does not just manage pipes: it operates treatment plants (ETA and ETE), pumping stations, reservoirs, distribution networks, and miles of telemetry that watch over pressure, flow, reservoir level, and quality parameters. This entire physical process is controlled by industrial automation systems, generically called OT (Operational Technology), with SCADA, PLCs (programmable logic controllers), and HMIs (human-machine interfaces) at the center of operations.

What makes the sector a high-value target is precisely the impact: unlike a purely digital company, in sanitation a successful compromise does not end in a locked screen, it ends in a physical consequence. An attacker who gains control over chemical dosing in treatment, over pump activation, or over distribution valves gains disproportionate power over water quality and over the supply of an entire region. That is the difference between an IT incident and a critical infrastructure incident.

The low tolerance for failure comes from the nature of the service. There is no 'acceptable degraded mode' for drinking water: either it is within sanitary parameters, or it poses a risk to the population. This raises the cost of any interruption and of any doubt about the integrity of the process. A single well-founded suspicion that dosing was manipulated can force the utility to interrupt distribution, issue public alerts, and notify health authorities, with immediate reputational and regulatory impact.

The technical legacy that widens exposure

A large part of Brazil's sanitation automation infrastructure was built over decades, with long-lifecycle equipment, legacy industrial protocols (such as Modbus and DNP3, which were born without authentication or encryption), and engineering workstations running old operating systems that cannot simply be updated without risking a shutdown of operations. Add to this the growing convergence between IT and OT — telemetry pushed to the cloud, corporate dashboards reading process data, vendors accessing remotely for maintenance — and the result is an attack surface that has grown faster than the security maturity of most utilities.

The five threats that weigh most on sanitation

Decripte approaches the sector from a concrete threat map, derived from how these environments actually operate. This is not a generic list of cyberattacks, but the vectors that, in sanitation, lead from unauthorized access to a physical consequence or a service interruption.

Why remote access is the Achilles' heel

Of all these vectors, insecure remote access to OT is the one that most often appears as the initial entry point. Water utilities depend on automation vendors and integrators who need to access the environment to configure PLCs, adjust SCADA screens, and resolve faults. When this access is done over a VPN with a shared password, without a second factor, without session logging, and with a direct route to the automation network, the leak of a single credential — through phishing, password reuse, or a compromised vendor laptop — is enough for a third party to reach the heart of the process.

The good news is that this same vector is highly addressable. There is no need to rebuild the automation infrastructure to drastically reduce risk: controlling how, by whom, and from where SCADA is accessed already eliminates most of the path an attacker would take.

Anatomy of unauthorized remote access to SCADA (anonymized real example)

To make the risk tangible, we describe below the typical anatomy of unauthorized remote access to the SCADA of a treatment plant. This is an anonymized real example, built from real patterns in the sector, and not from a specific client. It serves to show where defense needs to act and in what order.

How the attacker gets in

The starting point is almost always a credential. A technician from an automation vendor has remote access to the OT network for maintenance. Their personal machine is compromised by credential-stealing malware, or they fall for a phishing attack that captures the maintenance VPN username and password. Because this VPN does not require a second factor and leads directly into a segment that can see the SCADA engineering workstation, an attacker in possession of the credential is, within a few hops, already inside the environment that controls treatment.

What was at stake

With a presence on the engineering workstation, a malicious attacker would, in theory, have a path to alter chemical dosing set-points, manipulate pump and valve commands, or simply take down supervision, forcing blind manual operation. Any of these actions would have the potential to affect water quality or the continuity of supply. The difference between a contained scare and a public health incident lies entirely in the speed and quality of detection and response.

How Decripte detects what looks normal but is not

The great challenge of defending an OT environment is that many malicious actions use legitimate commands. Altering a dosing set-point is a normal operation — what changes is who did it, from where, when, and in what context. That is why sanitation monitoring cannot be limited to malware signatures: it must understand process and access behavior.

The layers of detection

Decripte combines industrial network visibility (passive inspection of protocols such as Modbus, DNP3, and OPC to understand commands and flows without interfering with operations), identity and access telemetry (who authenticated, from where, with which factor, at what time), and correlation with the IT environment (the engineering workstation that suddenly talks to an external IP, the vendor account that logs in outside the contracted maintenance window). The 24x7 SOC cross-references these signals to distinguish normal operation from anomalous action.

Passive inspection is an important point for the sector: in OT, you cannot introduce latency or instability into the network that controls the process. That is why visibility collection is done through traffic mirroring and sensors that only observe, without interposing themselves in the path of commands. Security that puts process availability at risk is not acceptable security in sanitation.

Containment before manipulation: Incident Response in sanitation

When the SOC identifies unauthorized access in progress, the number one priority in sanitation is to prevent it from escalating into process manipulation. Decripte's Incident Response operates with a containment SLA of up to 1 hour, but in OT environments containment must be surgical: taking down the wrong thing can cause exactly the unavailability you are trying to avoid.

Contain without taking down operations

Containment in sanitation is guided by the principle of preserving the safe operation of the physical process while cutting off the attacker's access. This means isolating the compromised segment or credential, blocking the remote access route used, and, when necessary, placing the plant into a controlled and safe manual operation mode — always in coordination with the plant's operations team, who know the limits of the process. The decision on any action that touches the field is made jointly, never unilaterally by the cybersecurity team.

In parallel with containment, the IR team begins collecting forensic evidence — access logs, remote sessions, command history, images of the compromised workstations — to understand the real scope of the incident, identify how far the attacker got, and ensure that eradication is complete. In sanitation, this investigation answers a question critical to public health: was the process altered or not? The answer to this question guides everything that comes after, including communication to health authorities and the population, if warranted.

Hardening: segmentation, MFA on OT, and monitoring

Containing an incident is necessary, but the long-term goal is to make unauthorized access hard to happen and easy to detect. The hardening that Decripte structures in sanitation rests on three fronts that, together, attack the most common vector in the sector: insecure remote access to OT.

Segmentation between IT and OT

The first barrier is to separate the corporate world from the automation world. Instead of a flat network where a compromised laptop in the office can see the plant's PLC, an architecture of zones and conduits is created, in the spirit of the IEC 62443 standard: the OT network stays in isolated zones, with a defined perimeter where all traffic between IT and OT passes through inspection and control. Telemetry flows up to IT through controlled and unidirectional paths whenever possible, so that process data can be read without opening a command path back to the field.

MFA and controlled remote access on OT

The second barrier directly attacks the vector from the anonymized real example. All access to the automation network — by employees or vendors — now requires multi-factor authentication and is mediated by a jump host with session recording. Vendor access is no longer permanent and becomes just-in-time: granted only during the contracted maintenance window, with approval, and automatically revoked at the end. As a result, a leaked credential alone is no longer enough to reach SCADA.

Continuous monitoring as a safety net

The third barrier is the 24x7 SOC already described, which assumes that no prevention is perfect and ensures that, if unauthorized access still happens, it is seen and contained within the window in which the attacker is still reconnoitering the environment. Segmentation, MFA, and monitoring are not alternatives to one another: they are layers that reinforce each other. Segmentation reduces the path, MFA closes the most common door, and monitoring ensures detection when something slips past the first two.

Offensive validation: Pentest of the OT environment

The only way to know whether the barriers really work is to test them the way an attacker would. Decripte's Pentest for sanitation validates, in a controlled and safe manner, whether the segmentation between IT and OT holds, whether remote access can be bypassed, whether vendor credentials are protected, and whether lateral movement from the corporate network could reach the SCADA engineering workstation.

The result of the Pentest is a realistic picture of the path an attacker would take and of the effectiveness of existing defenses, translated into recommendations prioritized by risk. For a utility, this exercise is also a governance instrument: it demonstrates to the board, to regulators, and to sanitation agencies that the security of critical infrastructure was independently verified, and not merely assumed.

Compliance, LGPD, and operational resilience

Sanitation deals with two dimensions of compliance at the same time. The first is data protection: utilities process the personal data of millions of consumers (registration, consumption, billing, collection), which places them fully under the Lei Geral de Proteção de Dados (LGPD) and under ANPD oversight. A leak of this data or an incident affecting personal data triggers notification obligations to the data subject and to the ANPD, in addition to the risk of administrative sanctions.

The second dimension is the security of critical infrastructure and the industrial process, where the technical reference is the IEC 62443 family of standards, focused on the security of industrial automation and control systems. Decripte structures the utility to demonstrate, with policies, controls, and audit trails, that the OT environment is managed according to recognized best practices — something increasingly required by sanitation regulators, by concession contracts, and by due diligence processes.

Resilience: surviving ransomware without stopping the city

Ransomware at utilities deserves its own attention because it attacks service continuity across the board: it can encrypt supervision, telemetry, billing, and ERP servers at the same time. The operational resilience that Decripte helps build includes isolated and tested backups, segregation that prevents propagation from corporate to automation, and contingency plans that allow the plant to operate in a safe manual mode if supervision is lost. The key resilience question in sanitation is simple and hard: if everything in IT goes down right now, can the utility keep drinking water safe and supply running? Security exists so that the answer is yes.

Where to start: diagnosis and building in layers

The security journey of a water utility does not begin with one big project all at once. It begins with visibility. Most utilities underestimate how many paths exist today between the corporate world and SCADA, how many vendor remote accesses are active, and which OT assets are not even inventoried. The first step is to see reality.

From the assessment, the build-out is layered and prioritized by risk: first, the most obvious doors are closed (insecure remote access, missing segmentation, absent MFA), then continuous visibility is installed via the 24x7 SOC, everything is validated with a Pentest and, in parallel, compliance and resilience are organized. Each layer already reduces risk on its own, which allows the utility to demonstrate progress from the start, without having to wait for the entire program to be ready to reap the benefit.

Anatomy of unauthorized remote access to the SCADA of an ETA (anonymized real example)

How Decripte responds to an incident at a water utility

Decripte's Incident Response in sanitation is designed around a non-negotiable priority: preventing unauthorized access from turning into a physical consequence before anything else. It operates with a containment SLA of up to 1 hour and always in coordination with the plant's operations team.

1. Detection and triage: the 24x7 SOC identifies the anomalous signal (access without MFA, out of window, unusual command on SCADA, reconnaissance on the OT network) and classifies severity considering the risk to the physical process, not just IT.
2. Activation and coordination: the IR team is mobilized and immediately connects with the plant's operations team, because no action that touches the process is taken unilaterally by cybersecurity.
3. Surgical containment: isolate the compromised credential and segment, block the remote access route used and, if necessary, bring the plant into a safe manual mode — always preserving the safe operation of treatment and supply.
4. Evidence preservation: collect access logs, remote sessions, command history, and workstation images, ensuring an intact forensic trail to answer the critical question: was the process altered or not?
5. Investigation and scope: reconstruct the attacker's path, confirm how far they got and whether any set-point, dosing, or field command was touched, guiding communication to health authorities if warranted.
6. Eradication: definitively remove the attacker's access, remediate the origin (e.g., a compromised vendor machine), rotate credentials, and deactivate insecure remote accesses.
7. Safe recovery: reestablish remote access on a hardened foundation (MFA, jump host, just-in-time, recorded sessions) and validate the integrity of supervision, telemetry, and process before returning to routine.
8. Lessons and hardening: consolidate the learnings, close the gaps that allowed the incident (segmentation, MFA, monitoring), and schedule validation via a safe OT Pentest.

How Decripte structures security for a water utility

The security structure that Decripte builds in sanitation rests on pillars that, together, reduce the attacker's path, close the most-used door, ensure detection of what slips through, and keep operations resilient and compliant.

Recommended plans for Water and Sanitation

Frequently asked questions

Sector terms

SCADA

Supervisory Control and Data Acquisition. It is the set of software and screens that allows an industrial process to be operated and monitored remotely — in sanitation, the chemical dosing, pumping, and distribution of water.

OT (Operational Technology)

Operational technology: the systems that control the physical world of an industrial plant (PLCs, HMIs, sensors, actuators), in contrast to IT, which handles data and administrative systems. In sanitation, OT controls treatment and distribution.

PLC

Programmable Logic Controller: the device that executes the process control logic in the field, actuating pumps, valves, and dosers according to commands from SCADA. It is one of the most sensitive assets to protect in OT.

IEC 62443

A family of international security standards for industrial automation and control systems. It defines concepts such as zones and conduits and security levels, serving as a reference for structuring and demonstrating the protection of OT environments.

Segmentation (zones and conduits)

The practice of dividing the network into isolated zones and allowing between them only the explicitly authorized communications (the conduits). It prevents a compromise in the corporate network from automatically reaching the industrial automation network.

Just-in-time access

A model in which privileged access — for example, from a vendor to the OT network — is granted only for the time needed and subject to approval, being automatically revoked afterward, instead of remaining always active.