How water and desalination operators found their OT security gaps and planned fixes around live plants.
Composite of four water and desalination engagements, 2017–2024. Details anonymised.
From 2017 to 2024, we carried out four OT cyber engagements for water utilities and desalination plant operators in the Middle East. Their plants run on SCADA and DCS, which control treatment, pumping and desalination. These systems also share more and more data with business IT.
Each operator needed a clear view of its cyber exposure. The national regulator had set cyber standards for SCADA and DCS, and links between OT and IT were growing. The work set out to find the gaps and risks, and to rank the fixes.
The scope covered SCADA, DCS and OT networks, the links between OT and IT, the security design and the asset lists. It also covered policies, procedures, risk management and compliance. Corporate IT was in scope only where it touched OT.
These plants were already running and supplying water around the clock. Standard IT security steps, such as active scanning, patching, restarts and network changes, could not simply be applied. Each step had to be weighed against its effect on the live process, vendor support and the maintenance windows available. Older control systems also limited what security they could support.
Links between OT and IT, engineering systems, remote support and data platforms needed care. Trust boundaries, access and network separation all had to be checked. Operations, IT, maintenance teams, operating contractors and suppliers each held part of the picture. So the first task was to get a true view of the systems in place and of who managed their security.
The regulator’s SCADA and DCS standards gave a framework. But compliance had to become steps the plants could take. The findings split policy gaps, technical weaknesses and fixes that needed engineering or supplier work. The aim was a plan operators could carry out and keep up.
We set each scope through site assessments, talks with operations, IT and engineering staff, and reviews of existing documents. We read the architecture drawings, asset lists, system settings, policies and procedures to build a baseline. We paid close attention to links between systems, access routes and the limits of working on live plants.
We used mainly non-intrusive methods. These were architecture reviews, configuration records, interviews and checks of how sites worked. We checked each site against the regulator’s SCADA and DCS standards and ISO 27001 controls. We looked for exposure in network links, access, settings, asset records, maintenance and security habits. We rated each finding by the weakness, the rule it missed and its effect on operations.
We wrote up findings in reports, gap analyses, risk registers and treatment plans. Where needed, we also drafted network design options, policies, procedures and security management documents. Our advice split fixes the sites could make through their own processes from those that needed technical change, vendor help or new budget.
Across the four engagements, we delivered assessment reports, gap analyses and asset lists. Depending on scope, we also delivered risk registers, treatment plans, network separation options, policies and procedures. Each operator got a written baseline: where it was exposed, where it fell short of the rules and what to do next.
We showed where live water control systems needed stronger protection, and how to plan fixes around plant operations.
The findings showed where security most needed work: links between OT and IT, access control, network separation, asset records and governance. They gave a basis for ranking fixes by risk, rules, plant limits and effort. Operators could see which fixes their own procedures could handle. They could also see which needed engineering, vendor help, an outage or new budget. The reports also supported compliance and management reviews.
