Massachusetts Water Program Urges PLC Hardening After Siemens S7 Threat Warning

Massachusetts turns a federal PLC alert into water-sector actions

Massachusetts’ Drinking Water Program used its August 25 “In the Main” newsletter to call attention to an active cyber threat affecting Siemens S7 Series programmable logic controllers (PLCs). The item follows an August 19 joint advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Energy and the Environmental Protection Agency.

The state newsletter frames the issue around a recurring OT exposure problem: controllers that can be reached from the public internet. It warns that attackers can exploit misconfigurations, unpatched weaknesses and outdated equipment when PLCs are readily accessible. The guidance is directed at water utilities, but its recommendations are also relevant to electrical contractors, control-panel builders and OT integrators who specify or support remote industrial sites.

Immediate priorities: exposure, credentials and controller mode

The newsletter lists two immediate measures. First, utilities should ensure that each PLC or human-machine interface has a long, random password. This is a useful prompt to eliminate default or shared credentials, confirm ownership of service accounts and protect remote-access paths used by employees and third-party service providers.

Second, Massachusetts advises keeping PLCs with a RUN/REMOTE option in the RUN position using the physical selector or LCD keypad. That setting should be evaluated alongside the process design and the manufacturer’s documentation; it is not a replacement for network controls. For integrators, the practical issue is to document the approved operating mode at commissioning, restrict changes to authorized personnel and record any configuration changes in the project handover package.

Near-term controls focus on remote connectivity

For sites that rely on cellular communications, the newsletter recommends considering a telecommunications provider’s private cellular network. It also calls for a firewall, VPN or another approach that isolates SCADA devices from the internet. In procurement terms, connectivity should be assessed as a complete architecture rather than as a modem or router purchase alone: determine who can initiate a connection, where authentication occurs, what systems are reachable after connection and how access is logged.

The newsletter also asks utilities to have their integrators verify whether the organization appears in internet-scanning services such as Shodan or Censys. That external-exposure check should be paired with an asset inventory that identifies controller model, firmware, installed communications modules, management interfaces, remote-support methods and the party responsible for each device. A controller can be difficult to secure if it is absent from the asset list or if a legacy vendor connection is undocumented.

Why configuration and log review matter

Massachusetts recommends regular review of settings, configurations and log changes. This aligns with the federal advisory’s emphasis on detecting unauthorized activity. In an OT setting, a review should include comparison against approved PLC and HMI project backups, examination of firewall and VPN logs, and alerting for unexpected remote sessions or configuration downloads.

Utilities and their service partners should preserve known-good controller logic and configuration files offline, establish a controlled process for modifying them, and test restoration procedures in a safe environment. The goal is not simply to retain backups; it is to be able to determine whether an installed project matches the approved process design and to recover predictably if it does not. Changes affecting alarms, interlocks or shutdown functions warrant particular scrutiny because an attacker’s impact can extend beyond a conventional IT outage.

The Siemens warning is specific, but the defensive lesson is broader

The August 19 federal advisory describes targeted reconnaissance and capability development against U.S.-based Siemens S7 PLC installations, including use of AI-generated scripts presented as legitimate monitoring tools. It identifies water and wastewater among the affected critical-infrastructure sectors and calls for patching, internet isolation, stronger access controls and monitoring for suspicious activity.

Siemens subsequently updated its own industrial-control-systems security bulletin to reference the advisory. The company advises customers to keep devices current, remove devices from insecure networks or place protective controls such as firewalls in front of them, and use strong unique passwords. Importantly, the federal agencies state that ongoing PLC targeting is broader than Siemens. Asset owners should therefore apply the Massachusetts checklist to all internet-reachable industrial controllers and associated modems, remote-access appliances, HMIs and engineering workstations—not only to S7 installations.