FOR IMMEDIATE RELEASE
Media Contact:
Ben Frech National Ground Water Association Public Relations Manager bfrech@ngwa.org
Water Well Journal Column Lays Out 12 Steps to Protect Water System Controls from Cyber Threats
Final installment of “The Water Works” engineering series covers important steps to securing water systems
Westerville, Ohio (September 28, 2026) —The National Ground Water Association’s monthly trade publication, Water Well Journal, published an installment of its engineering series by columnist Ed Butts, PE, CPI, “The Water Works,” focusing on cybersecurity for water and wastewater control systems.
The column, in the WWJ October 2026 issue, is being published as utilities nationwide respond to a wave of cyberattacks. The FBI and U.S. Environmental Protection Agency reported that since July 27, utilities in at least seven states have experienced incidents involving internet-exposed programmable logic controllers, with some degrading water operations. Reports have since put the number of affected states at 12 or more. In Minnesota alone, attacks reached utilities in more than 30 communities, according to The Pew Charitable Trusts.
Explaining how these threats have increase, Butts explains that Supervisory Control and Data Acquisition (SCADA) systems evolved from closed, proprietary designs to open, networked platforms, a shift that improved access but also widened the ways an attacker can get in.
The column challenges several assumptions that leave systems exposed. Butts calls the idea that an unconnected control system is safe “essentially a myth,” noting industrial networks average 11 direct connections to enterprise networks, according to the U.S. Department of Homeland Security. He adds that a virtual private network alone does not guard against someone with physical access to network jacks and switches, and that complexity or limited public knowledge of a system is no defense against increasingly sophisticated attackers.
To reduce risk, the column recommends a tiered, three- to four-level password structure that separates read-only monitoring from setpoint changes, pump operation, and system programming. Among Butts’ 12 recommendations are assembling a cross-knowledgeable work group, completing an annual security audit and asset inventory, and partnering with an experienced SCADA integrator. He also calls for isolating the control network from billing and office systems, using properly configured firewalls, keeping software patched, and changing passwords regularly.
On the operational side, he advises logging abnormal events, maintaining independent backup control that can run the system for up to two weeks, and locking out remote changes to chemical feed and pumps. Remote access, he says, should be limited to observation only, and utilities should avoid buying control systems more complex than they can operate.
Butts is chief engineer at 4B Engineering & Consulting in Salem, Oregon, and received NGWA’s 2025 Technology Award.
WWJ is an award-winning publication in its 80th year and is the leading industry resource for business owners in the water well industry.
Read the full column at https://waterwelljournal.com/engineering-of-water-systems-37/. “The Water Works.”
_______________________________________________________________________
The National Ground Water Association is a not-for-profit professional society and trade association for the global groundwater industry. Our members around the world include leading public and private sector groundwater scientists, engineers, water well system professionals, manufacturers, and suppliers of groundwater-related products and services. The Association’s vision is to be the leading groundwater association advocating for responsible development, management, and use of water.