A live path into a Texas water district's control systems.
A real-world look at how an “air-gapped” environment was found exposed to the public internet — and what was done about it. One independent advisor. Three security domains. One remediation strategy.
Anonymized. All identifying details about the client district, its personnel, and its facilities have been removed or generalized.
What was believed
Water Plant 1 and Water Plant 2 control systems operated on an isolated network with no obvious path from the public internet.
What an independent assessment found
Both plants were connected to the internet through modems no one was managing. No industrial firewall protected the control systems, and remote-access software was left running and reachable around the clock.
- Facilities assessed
- 3 2 water plants + 1 WWTP
- Vulnerabilities
- 14 2 high, 11 medium, 1 low
- Exposure areas
- 4 Addressed by one plan
Findings across disciplines
No industrial firewall
- Unattended remote access
- No intrusion detection
- No network traffic monitoring
Access & perimeter gaps
- Generic / shared master codes
- Structural perimeter barrier gaps
- Unsecured ingress points
Fragmented response
- Alert fatigue
- Siloed response protocols
- No unified escalation path
One coordinated strategy
Findings from three disciplines were brought into one remediation plan under one advisor, rather than handled as separate projects.
Priorities
DDG’s role included risk prioritization. The findings were organized into one remediation plan across four exposure areas.
Roles
District Defense Group
- Lead advisor & project manager
- Physical & operational security
- Risk prioritization
- Remediation management
- Board-level reporting & accountability
Vetted ICS & OT Specialists
- Industrial control systems (ICS) engineering
- OT / SCADA cybersecurity
- Network analysis & technical remediation
Implementation & validation
Each exposure area was paired with a remediation. The remediations were implemented and validated.
No industrial firewall protecting the control environment.
Purpose-built industrial firewalls designed and lab-tested for deployment at the water plants.
Unattended remote-access applications created persistent external connectivity.
Remote access transitions to secured, logged, and monitored VPN connectivity.
No continuous intrusion detection or network monitoring.
Continuous managed monitoring, alert analysis, and defined escalation.
Shared credentials, physical vulnerabilities, and siloed response protocols.
Stronger access controls and unified escalation across physical security, operations, and cyber monitoring.
What continues
24×7 monitoring, alert analysis, and defined escalation were established through remediation.
Start with the outcome your Board wants.
Every engagement begins with a confidential conversation about what your district needs to accomplish.