Cybersecurity in critical infrastructure

Systems integration is never routine. Whether we’re working on municipal water systems or commercial facilities like hospitals, universities, and high-rise buildings, one truth stands out: automation is everywhere, and cybersecurity is often an afterthought. That needs to change.

Water utilities have long been recognized as critical infrastructure, but consider a hospital or a 50-story office tower. These environments rely on automated pumping, HVAC, and life-safety systems. A cyber incident that disables these controls could halt operations, compromise patient care, or even create life-threatening conditions. The same vulnerabilities we see in municipal SCADA—weak authentication, outdated software, unsecured remote access—exist in building automation systems (BAS). The stakes differ, but the consequences are equally severe.

Common vulnerabilities across both sectors

1. Shared credentials and lack of accountability

In many installations, everyone uses the same login—or worse, no login at all. Without individual accounts, there’s no audit trail, no way to enforce role-based permissions, and no accountability. For water utilities, this violates guidance from the American Water Works Association (AWWA). For commercial facilities, the risk is amplified by the growing adoption of Internet of Things (IoT) devices and building automation. These systems often integrate HVAC, lighting, and security controls, creating a large, interconnected attack surface. When credentials are shared, a single compromised account can grant attackers access to multiple building systems, enabling them to manipulate controls, disable alarms, or even lock out operators. Proper identity management isn’t just best practice—it’s crucial for maintaining operational integrity in highly connected environments.

Best practice: Implement unique user accounts with role-based permissions. Audit logs should be standard, not optional.

2. Multi-factor authentication (MFA)

Passwords like “water123” or “building1” are still common. Human nature doesn’t change, so layered defenses are essential. MFA—already standard in banking and healthcare IT—should be mandatory for SCADA and BAS. A time-based one-time password (TOTP) or SMS code adds a critical barrier against credential theft.

Reality check: Yes, MFA adds a step. But when the alternative is a ransomware attack that shuts down a hospital’s HVAC system, the inconvenience is negligible.

3. Remote access: Convenience vs. risk

Remote access is essential for modern operations, but it’s also the Achilles’ heel of many systems. We’ve seen engineering workstations with consumer-grade remote desktop tools left running—sometimes with saved credentials. That’s an open door for attackers.

The Cybersecurity and Infrastructure Security Agency (CISA) repeatedly warns that remote desktop is a top attack vector for critical infrastructure. The same applies to commercial facilities. If an attacker gains OS-level access, they can deploy malware that compromises not just the BAS, but the entire corporate network.

Solution: Use secure, SCADA-specific remote access tools with MFA and logging. Avoid generic IT shortcuts.

4. Outdated software and “Set it and forget it”

Utilities and building managers often treat automation systems like pumps: install them and walk away. But software isn’t static. Vendors release patches for known vulnerabilities (CVEs) regularly. Ignoring updates leaves systems exposed.

In commercial settings, this risk multiplies because BAS often interfaces with IT networks. An unpatched controller can become a pivot point for attackers targeting corporate or system data.

Action item: Schedule routine updates for SCADA and BAS software. Isolate or replace legacy hardware that can’t be secured.

5. Physical security still counts

Cybersecurity starts at the keyboard. If someone can walk up to a SCADA terminal or BAS workstation and make changes without logging in, all your firewalls and safety measures are meaningless. We’ve seen remote pump stations and mechanical rooms with programmable logic controllers (PLCs) become easy backdoors into the network.

Recommendation: Require logins for all operational changes. Default displays should be read-only. And yes, lock the door and your workstation.

The commercial connection: Why this matters now

Hospitals, universities, and high-rise complexes are increasingly adopting Internet of Things (IoT)-enabled systems for energy efficiency and sustainability. These innovations bring benefits—but also new vulnerabilities. A ransomware event that disables a hospital’s chilled water system could force patient evacuations. A breach in a high-rise BAS could shut down elevators and fire suppression systems.

Cybersecurity isn’t just an IT issue; it’s an operational imperative. And for integrators, they’re on the front lines. Their role isn’t just wiring panels and tying in software—it’s designing resilience to keep our water safe.

The way forward

Cybersecurity is a shared responsibility. Vendors must design secure systems. Consulting engineers must specify best practices. Integrators must refuse shortcuts. And operators—whether in a water plant or a hospital—must stay vigilant.

The threats are real, but so are the solutions. With the right mindset and partnerships, we can protect the infrastructure that sustains life—whether it’s clean water or climate control in a surgical suite.

A cybersecurity checklist

• System Access Control: Unique accounts, user privileges, immediate revocation for terminated staff.
• Remote Access: No consumer-grade tools. Use VPNs with MFA and logging.
• System Hygiene: Patch regularly. Retire unsupported/outdated hardware.
• Culture & Training: Teach staff to spot phishing and social engineering. Define an incident response plan.