NGWA's monthly trade publication, Water Well Journal, published an installment of its engineering series by columnist Ed Butts, PE, CPI, “The Water Works,” focusing on cybersecurity for water and wastewater control systems.
The column, in the October 2026 WWJ issue, is being published as utilities nationwide respond to a wave of cyberattacks. The FBI and U.S. Environmental Protection Agency reported that since July 27, utilities in at least seven states have experienced incidents involving internet-exposed programmable logic controllers, with some degrading water operations. Reports have since put the number of affected states at 12 or more. In Minnesota alone, attacks reached utilities in more than 30 communities, according to The Pew Charitable Trusts.
Explaining how these threats have increase, Butts explains that Supervisory Control and Data Acquisition (SCADA) systems evolved from closed, proprietary designs to open, networked platforms, a shift that improved access but also widened the ways an attacker can get in.
The column challenges several assumptions that leave systems exposed. Butts calls the idea that an unconnected control system is safe “essentially a myth,” noting industrial networks average 11 direct connections to enterprise networks, according to the U.S. Department of Homeland Security. He adds that a virtual private network alone does not guard against someone with physical access to network jacks and switches, and that complexity or limited public knowledge of a system is no defense against increasingly sophisticated attackers.
To reduce risk, the column recommends a tiered, three- to four-level password structure that separates read-only monitoring from setpoint changes, pump operation, and system programming. Among Butts’ 12 recommendations are assembling a cross-knowledgeable work group, completing an annual security audit and asset inventory, and partnering with an experienced SCADA integrator. He also calls for isolating the control network from billing and office systems, using properly configured firewalls, keeping software patched, and changing passwords regularly.
On the operational side, he advises logging abnormal events, maintaining independent backup control that can run the system for up to two weeks, and locking out remote changes to chemical feed and pumps. Remote access, he says, should be limited to observation only, and utilities should avoid buying control systems more complex than they can operate.
Butts is chief engineer at 4B Engineering & Consulting in Salem, Oregon, and received NGWA’s 2025 Technology Award. Click here to read the column.
WWJ is an award-winning publication in its 80th year and is the leading industry resource for business owners in the water well industry.