A shared responsibility
Water is fundamental to our communities, industries, and daily lives. The systems that treat, move, monitor, and protect it deserve an architecture designed with the same level of care.
Software Toolbox serves more than 380 cities, authorities, districts, and companies in the water and wastewater sector worldwide. With that reach comes responsibility.
We believe the knowledge gained across those environments should be shared openly when it can help make the broader community safer. This guide brings together practical recommendations and architectural best practices for building more secure, resilient OT environments.
Built with practical water-sector perspective
This guide was reviewed with valuable input from professionals at EPCOR USA and the City of Peoria Water Services Department. We are grateful for their willingness to share real-world perspective with the broader water and wastewater community.
According to NBC News, recent cyberattacks targeted operational technology environments at municipal water facilities and disrupted monitoring and control capabilities. The FBI, EPA, and CISA have urged utilities to strengthen the architecture of their industrial control systems, not simply individual devices. That is an important reminder for every industrial organization, not only water utilities.
The message from federal agencies is remarkably consistent:
The greatest cybersecurity risk is often not the PLC itself. It is the architecture surrounding it.
Software Toolbox products help reduce exposure by minimizing attack surfaces, supporting secure protocols such as DNP3 Secure Authentication (SAv5), and enabling segmentation. An active Maintenance agreement also provides access to security-related releases as new vulnerabilities are discovered.
Explore solutions for secure, resilient water and wastewater operations.
Industrial cybersecurity conversations often begin with firewalls, passwords, and endpoint protection. Those are all important, but many successful attacks begin before an attacker exploits a vulnerability. Malicious actors enter a network, then wait for a usable weakness. They get in because industrial assets are exposed in ways they were never intended to be.
Too often, we still see architectures where:
Direct connections increase complexity, and unnecessary connections increase risk. Rather than asking how to secure every connection, organizations should ask: Why do these connections exist in the first place?
As manufacturers and utilities accelerate their adoption of Industrial AI, historians, cloud analytics, and Unified Namespace architectures, secure connectivity becomes more important than ever.
Many organizations connect each new application directly to PLCs. That creates more endpoints, more credentials, more maintenance, and a larger attack surface.
A better approach
Build a secure industrial data layer that becomes the trusted source of operational information for the organization. Instead of every application communicating directly with industrial controllers, applications consume data from a centralized, managed connectivity platform.
That architectural shift reduces complexity while improving scalability, reliability, and governance.
In practice: Software Toolbox products such as TOP Server, Cogent DataHub, OPC Router, and N3uron help organizations centralize communications, segment networks, standardize data exchange, and securely deliver operational data to enterprise and AI applications.
PLCs were designed to control industrial processes, not to defend against sophisticated cyber threats. Exposing controllers directly to external networks creates unnecessary risk.
The FBI and EPA specifically recommend placing PLCs behind secure gateways and firewalls rather than allowing direct Internet access. A secure industrial data layer gives applications access to the data they need without giving them direct access to controllers.
That layer is responsible for:
This approach strengthens security and makes systems easier to maintain over time. TOP Server can help centralize industrial communications so applications connect to a managed connectivity layer rather than creating multiple direct pathways to PLCs.
SCADA systems, historians, MES platforms, ERP systems, cloud analytics, AI assistants, and digital twins all require access to operational data. Without the right architecture, every one becomes another direct consumer of PLC data.
A secure architecture centralizes communications rather than multiplying direct PLC connections.
Platforms such as Cogent DataHub and TOP Server help establish this industrial data layer. They securely collect, aggregate, and distribute operational data to SCADA, historians, MES, cloud platforms, and enterprise applications without requiring each system to communicate directly with controllers.
The Purdue model provides a deeper version of this framework. While modern architectures can blur some traditional boundaries, the core principle remains valuable: systems should have access to the operational data they need without automatically gaining direct access to the systems that produce it.
Modern industrial architecture increasingly relies on open standards such as OPC UA and MQTT. When organizations implement them correctly, these technologies help decouple applications from control systems.
OPC UA provides secure, standardized industrial communications with support for authentication, encryption, and structured information models. MQTT enables efficient publish/subscribe communications that eliminate many traditional point-to-point integrations.
Cogent DataHub and OPC Router can simplify the adoption of OPC UA and MQTT, enabling secure, standards-based data exchange between OT and IT while reducing custom integrations and point-to-point connections.
One of the FBI's strongest recommendations is network segmentation. Industrial gateways play an essential role in achieving that objective.
Rather than exposing PLCs directly, gateways provide a controlled interface between operational technology and enterprise systems. This creates a clear separation between control systems, operations, enterprise IT, cloud platforms, and AI applications.
Segmentation reduces opportunities for lateral movement while providing greater visibility into industrial communications. Industrial edge platforms such as N3uron enable secure gateways between operational technology and enterprise systems, supporting segmented architectures and protocol conversion. Tunnellers in N3uron and Cogent DataHub support controlled data movement without exposing PLCs directly to external networks.
Industrial AI is transforming manufacturing, energy, water, and critical infrastructure, but AI should never communicate directly with production controllers.
AI does not need direct access to PLCs. It needs trusted, contextualized operational data.
A secure industrial data layer provides AI with the information it needs while maintaining appropriate separation from critical control systems. This delivers reduced cybersecurity risk, better data governance, consistent operational context, easier scalability, and a more future-ready architecture.
Software Toolbox products such as TOP Server, Cogent DataHub, OPC Router, and N3uron can provide the trusted, contextualized data layer used by ChatUNS.ai.
Secure by design
Software Toolbox helps organizations build industrial architectures that eliminate unnecessary exposure, simplify connectivity, and enable trusted access to operational data.