🔒 Utility Cybersecurity Checklist
Use this checklist to verify your operational technology (OT) and IT environments are protected against targeted attacks.
Recent Threat Alert: Coordinated cyberattacks in August 2026 targeted U.S. water utilities in at least 12 states. Attackers exploited internet-facing PLCs with no passwords, no firewalls, and no VPNs. Review all items immediately.
IT/Admin ports should never be exposed to the internet on a utility network. OT/ICS protocol ports must be air-gapped. If they’re bridged to a flat corporate network—or worse, the WAN—attackers can pivot directly into physical control systems.
| Port | Service / Protocol | Typical Target | Risk |
|---|---|---|---|
| 3389 | RDP | Engineering workstations, SCADA servers | Critical — #1 ransomware entry point for utilities |
| 22 | SSH | Linux PLCs, edge gateways, pumps | Critical — brute-force, stolen keys, unpatched OpenSSL |
| 445 | SMB | File servers, Windows SCADA hosts | Critical — EternalBlue, ransomware propagation |
| 5985/5986 | WinRM | Windows admin, PowerShell remoting | Critical — often enabled and forgotten on flat networks |
| 5900 | VNC | Plant HMIs, operator consoles | Critical — frequently no password or weak password |
| 23 | Telnet | Legacy RTUs, serial-to-Ethernet gateways | Critical — cleartext credentials, still alive on old gear |
| 80 / 443 | HTTP / HTTPS | Firewall admin panels, HMI web interfaces, BMS | Critical — exposed web admin is a direct path to OT |
| 502 | Modbus TCP | PLCs, pumps, valves | Critical — August 2026 water attacks hit this directly |
| 44818 | EtherNet/IP | Allen-Bradley, Rockwell gear | Critical — common in water treatment SCADA |
| 2222 | Fox (Triconex) | Safety instrumented systems | Critical — Triton malware used this to target safety controllers |
| 2404 | IEC 60870-5-104 | European/water SCADA RTUs | High — no built-in authentication in many implementations |
| 20000 | DNP3 | Power utilities, large water districts | High — widely used in North American critical infrastructure |
| 1911 / 4911 | Niagara Fox | Building automation / HVAC touching OT | High — often exposed with no authentication |
Attack pattern: Attackers rarely hit Modbus (502) from the open internet directly. They hit RDP (3389) or web admin (443) on a corporate laptop, move laterally through the flat network, and then talk OT protocols from an already-compromised internal host. Air-gapping and network segmentation are your primary defenses.
Recent Posts
-
Critical hardening steps for water, power, and municipal utilities. -
VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations -
VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities
-
VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure
-
VU#790363: foreUP golf management platform’s web API contains multiple vulnerabilities