FBI Warns of Ongoing Attacks on Water Infrastructure: What Municipalities Can Do Right Now

The FBI and EPA are warning that persistent threat actors are actively targeting U.S. water and wastewater infrastructure, including operational technology (OT) like programmable logic controllers (PLCs). Incidents are being reported across multiple states, and federal agencies are urging organizations to act now.

Most municipalities already know security matters. That's not the gap. The gap is finding something that fits a limited budget and can actually deploy this week, not after the next capital planning cycle.

The Recommendations That Actually Matter

The FBI's guidance covers a lot of ground, but a handful of items stand out because they don't require new hardware to start:

Remove inbound port exposure so OT systems aren't directly reachable from the internet.
Strictly control network access to critical infrastructure.
Encrypt communications between facilities and remote operators.
Plan for replacement of end-of-life hardware that no longer gets security updates.

None of this is exotic. It's the same network hygiene that gets recommended year after year. It works because it shrinks the attack surface without touching the OT device itself.

before-1

after-1

The Reality for Small and Mid-Sized Utilities

A lot of utilities run PLCs, SCADA systems, and networking gear that's been in service for a decade or more. Replacing all of it at once isn't realistic for most budgets, and cybersecurity funding competes with every other line item a utility has to justify.

That's exactly why segmentation and access control are usually the fastest, cheapest mitigation on the table. Put a secure gateway in front of an OT subnet and the control system stops being directly exposed to the outside world. Add site-to-site VPN between facilities and the traffic in transit is encrypted. Manage it all centrally and you get consistent policy across every site instead of whatever gets configured locally on a case-by-case basis.

What This Looks Like in Practice

An immediate mitigation, deployable without touching the existing OT equipment, looks like this:

Place a High Availability pair of Netgate® secure gateways in front of every critical OT network segment.
Use pfSense® Plus to restrict inbound access and enforce firewall policy at each site.
Build site-to-site VPN tunnels to encrypt traffic between plants, lift stations, remote facilities, and the admin network.
Use the Snort version 3 IPS package in pfSense Plus to protect against anomalous traffic and attack attempts
Manage it all through Netgate Nexus, which adds centralized visibility using Zero Trust Network Access (ZTNA) on top.

The PLCs and SCADA systems stay exactly where they are. This adds a security layer around them while the longer-term modernization plan comes together.

Affordable and Deployable Now

Cost is the real obstacle for most smaller municipalities, so let's be specific: Netgate appliances running pfSense Plus start well under $1,000, include security updates for the life of the device, and ship today. There's no year-two bill just to keep getting patched.

If you need help, Netgate's Professional Services group can work directly with utility staff or your MSP to size the right appliance, design the segmentation, configure the VPN tunnels, set up security policy, and handle the deployment.

Free online training and certification are also available if you'd rather build that capability on your own team.

Need help choosing the right appliance for your environment? Contact our sales team for personalized guidance.

Conclusion

The FBI's warning is direct: get exposure down now. Removing direct internet access, controlling network access, and encrypting communications between sites are the highest-leverage actions available today, and none of them require replacing a single PLC.

For utilities working with limited budgets, an affordable firewall and VPN deployment can go in now while the larger infrastructure replacement gets planned on its own timeline.

Need protection right now? Netgate secure gateways are in stock and ready to ship today.

Featured Story