The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released guidance to help organizations identify systems accessible from the internet, remove unnecessary remote access and secure internet-facing assets. The guidance focuses on reducing an organization’s exposure to potential cyber threats by identifying externally accessible systems and addressing access that is not required. It also concentrates on reducing internet exposure as a way to strengthen cybersecurity defenses, and calls on organizations to assess which systems are reachable from the internet, eliminate unnecessary remote access and secure systems that must remain externally accessible.
In its ‘Internet Exposure Reduction Guidance,’ CISA recognized that the range and number of internet-accessible assets, including industrial internet of things (IIoT), supervisory control and data acquisition systems (SCADA), industrial control systems (ICS), and remote access technologies, continues to grow. “In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem. Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary,” it added.
Organizations should begin by identifying assets accessible through the internet and use scanning tools and services, including CISA’s Cyber Hygiene Vulnerability Scanning service and web-based tools for identifying internet-exposed IT and OT assets, to gain visibility into their online footprint. They should also determine whether integrators, managed security service providers, vendors or other third parties have remote access to systems or networks through VPN credentials, cellular modems or other technologies.
CISA recommends verifying third-party connections by obtaining the external internet protocol addresses of systems set up by integrators and requesting updates when those addresses change, while using available web-based tools to verify that those connections are secured.
Organizations should then determine which assets need internet access for operational purposes and remove or restrict access to systems that do not require it. For assets that must remain internet-accessible, CISA recommends changing default passwords, applying the latest security patches and replacing software or devices that no longer receive security support.
They must also use a jump host to provide secure and monitored access, monitor ingress and egress traffic for anomalous activity, and implement and enforce multifactor authentication where possible, including at the jump host level. CISA further recommends reviewing secure remote access considerations for OT environments and regularly assessing internet-accessible assets as IT and OT environments evolve to identify and address new exposures.
In its Internet Exposure Reduction Guidance, CISA urged critical infrastructure organizations to route necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU). Also, organizations should require unique usernames, strong passwords, and phishing-resistant MFA for all remote access. Authentication controls should withstand brute-force attempts and other credential-based targeting.
The July 2026 malicious cyber activity targeting water and wastewater systems (WWS) entities demonstrates the consequences of directly exposing PLCs to the internet. Threat actors remotely accessed internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.
Apart from securing remote access, the Internet Exposure Reduction Guidance called upon organizations to routinely use web-based exposure discovery tools to identify internet-exposed IT and OT assets associated with their environments.
CISA recommends searching both known organizational IP address space and assets that may be improperly exposed through vendors, contractors or legacy infrastructure. These tools can provide visibility into an organization’s internet attack surface by assessing and indexing IP addresses, parsing transport layer security (TLS) certificates and tracking domains. Examples include Shodan, Censys, Thingful and Shadowserver. CISA notes that the inclusion of these tools in its guidance does not imply endorsement by CISA or the U.S. government.
Organizations should routinely scan public IP address ranges to identify ports and services accessible from the internet, investigate unexpected open ports and determine whether the associated systems or services require internet access. Ports without a documented operational need should be closed or have their access restricted.
Organizations can use structured queries to identify exposed systems, including Common Industrial Protocol (CIP) devices within their IP address ranges. They should also check for ports commonly associated with remote access and OT/ICS protocols, including SSH, Telnet, HTTP, HTTPS, RDP, Modbus, Niagara Fox, EtherNet/IP, VNC, TeamViewer, DNP3, OPC UA, and BACnet. An open port does not necessarily indicate a vulnerability or compromise, but organizations should investigate internet-accessible OT and remote access services, verify that such exposure is necessary, and remove unnecessary exposure. Routinely conducting these searches can help organizations identify unintended exposure of critical OT assets and remediate issues before cyber threat actors can exploit them.
Commenting on CISA’s Internet Exposure Guidance, Mayuresh Dani, Security Research Manager, Qualys Threat Research Unit (TRU), wrote in an emailed statement that for CISOs, “the guidance explicitly mentions that integrators, MSSPs, vendors, and other third parties that remotely access any of your digital assets by means of VPNs and other remote methods are responsible for securing their access. In short, your shadow exposure inventory is now incomplete until it covers vendors and other such provisioned access. Those contractual obligations are now mandatory.”
“At a minimum, changing default passwords, installing latest updates, and replacing EOS assets are a must in addition to using a jump host for monitored access, as well as monitoring ingress and egress for anomalies,” he added. “The guidance also shares a minimum documented port list. It should not be considered as final and any unexpected open port should be investigated, monitored for access and sufficiently protected from unauthorized access.”
Dani highlighted that “Special care must be taken while provisioning access for PLC, HMI, or RTU. They should never be allowed to connect remotely without a secure gateway/firewall/VPN or other centrally managed solution.”
“Many of these Operational Technology (OT) systems were never designed with cybersecurity in mind,” according to Louis Eichenbaum, federal CTO at ColorTokens. “They were built for reliability and availability, not to withstand modern nation-state cyber threats. Unfortunately, many remain internet-facing, poorly segmented, and inadequately monitored. This is exactly why the cybersecurity conversation must move beyond prevention alone. We are never going to patch fast enough or prevent every intrusion. The focus now must be on resilience, assuming an adversary may gain access and ensuring they cannot move laterally or manipulate critical operations at scale.”
He added that granular microsegmentation and zero trust principles are essential in OT environments because they help contain breaches, restrict unauthorized communications, and reduce the blast radius when a compromise occurs. The goal is not simply to stop every attack, but to ensure that a localized intrusion does not become a catastrophic operational event.
“For many years, OT has prioritized uptime over security and threat actors know this, which is why they continue to compromise these OT environments in the way they do,” Christopher Hills, chief security strategist at BeyondTrust, wrote in an emailed statement. “We have seen this same type of attack with the Aliquippa Water Plant, where threat actors targeted the PLC that was broadcasting Modbus (Port 502) on the public internet. They leveraged this as their foothold into their PLC and then pivoted to the Human Machine Interface (HMI) which had default credentials that were never changed, and used this to install a lightweight web shell for persistence, ultimately defacing the HMI screen and attempting to shut down the pumps and disrupt water pressure. These types of legacy systems do not use modern technology or security to secure.”
However, Hills pointed out that one thing remains – foundational security practices do not need modern security to take basic steps in security. “Default admin and passwords are considered foundation security practices. Ensuring they are either turned off, managed, or at a minimum, rotated from their default/shipped state. This is where many organizations, including IT, tend to forget about the basics when it comes to foundational security. And in most IT environments, you have additional layers of security that typically help layer some of this access, which makes it harder in most IT environments. Unfortunately, this is not the case in OT. OT does not have these additional security layers to help protect them and are therefore vulnerable right from the start. This is why you see NIST creating a special project/team to address critical infrastructure and OT, because they know this is a weakness across all OT environments.”
He added that understanding the convergence between IT and OT is so critical and Zero Trust Architecture excels in OT. “Because OT environments cannot leverage modern security controls, it is imperative that these environments embrace Zero Trust architecture to create a security boundary from access both from the public web and internal access. This is a step in the right direction to create a buffer and gate any inbound and outbound access due to an OT environment’s lack of security controls. Obviously, ensuring default login and passwords should already be a layer and managed or rotated, and any public-facing, direct access should be turned off.”
“Threat actors already know our weakest infrastructure is our critical infrastructure, whether it be in our utilities sector or other OT,” Hills said. “If we do not find a way to modernize these legacy systems, put modern security controls in place, and guard them against attacks, we will continue to suffer and see breaches and compromises across OT environments.”
