Threat actors can use Internet-based search and discovery platforms to identify publicly accessible systems with misconfigurations, default credentials, and outdated software which they can exploit to gain unauthorized access.
By following the guidance below from the Cybersecurity and Infrastructure Security Agency (CISA), organizations can go about identifying Internet exposures, removing those that are unnecessary, and secure those that are necessary, strengthening their cybersecurity posture.
In July 2026, CISA observed malicious cyber activity targeting over 100 Internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem.
Security Risks
Directly connecting PLCs to the Internet through cellular modems can create significant security risks. However, Internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.
- The following are some steps CISA said could reduce Internet exposure:
- Assess your current exposure: Begin by identifying which of your assets are accessible via the internet. Utilize tools and services (e.g., CISA’s Cyber Hygiene Vulnerability Scanning service as well as the Web-Based Tools for Identifying Internet-Exposed IT and OT Assets) that can scan for publicly exposed systems to gain visibility into your organization’s online footprint.
- Evaluate your necessity of exposure: Determine which assets need to be Internet-accessible for operational purposes. For those that do not need to be internet accessible, implement measures to remove or restrict access.
- Mitigate risks to remaining exposed assets: Follow these steps to protect any assets that must remain internet-accessible:
— Change default passwords.
— Ensure systems are up to date with the latest security patches.
and replace software and devices that are no longer receiving security support.
— Use a jump host to provide secure, monitored access.
— Monitor ingress and egress traffic to identify anomalous activity that requires further investigation.
— Implement and enforce multifactor authentication (MFA) where possible, even if only at the jump host level.
— Review the considerations in the Secure Remote Access to OT Environments section. - Establish routine assessments: Regularly review and monitor your Internet-accessible assets. As your organization’s IT and OT environments evolve, continuous assessments help maintain a secure posture and quickly identify new exposures.
Secure Gateways
CISA urges all critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).
Additionally, organizations should require unique usernames, strong passwords, and phishing-resistant MFA for all remote access. Authentication controls should withstand brute-force attempts and other credential-based targeting.
The July 2026 malicious cyber activity targeting WWS Sector entities demonstrates the consequences of directly exposing PLCs to the Internet. Threat actors remotely accessed Internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.
In addition to securing remote access, entities should routinely use web-based exposure discovery tools to identify internet-exposed IT and OT assets associated with their organization.
Entities should use these tools to search for known organizational IP space and any assets that the entity could possibly be improperly exposing under vendor, contractor, or legacy infrastructure.
Many web-based exposure discovery tools offer unique capabilities for assessing and indexing IP addresses, parsing transport layer security (TLS) certificates, and tracking domains to provide a comprehensive view of an organization’s Internet attack surface.
These web-based tools support attack surface reduction activities by providing visibility into various internet-exposed assets. They integrate with vulnerability tools, logging aggregators, and other scanning systems, which facilitates their incorporation into an entity’s infrastructure.
Secure Ports
At a minimum, check for the following ports commonly associated with remote access and OT/ICS protocols:
- 22/TCP – SSH: Remote administrative access
- 23/TCP – Telnet: Unencrypted remote administrative access
- 80/TCP – HTTP: Web interfaces and device management
- 443/TCP – HTTPS: Secure web interfaces, device management, and some remote access services
- 3389/TCP – RDP: Windows Remote Desktop
- 502–507/TCP – Modbus: Industrial device communications
- 802/TCP, 1051/TCP, 4001/TCP, 5000/TCP, 5252/TCP – Modbus: Additional ports associated with Modbus implementations
- 1911/TCP and 4911/TCP – Niagara Fox: Building and industrial control communications
- 2222/UDP and 44818/TCP – EtherNet/IP: Industrial automation and PLC communications
- 5900 – VNC
- 5938 – TeamViewer
- 19999/UDP and 20000/TCP/UDP – DNP3: SCADA and industrial communications
- 4840/TCP and 4843/TCP – OPC UA: Industrial automation communications
- 47808/TCP – BACnet: Building automation and control networks
An open port does not necessarily indicate a vulnerability or compromise. However, organizations should investigate any Internet-accessible OT or remote access service, verify the exposure is necessary, and remove unnecessary exposure.
By routinely performing these searches, entities can identify unintended Internet exposure of critical OT and remediate issues before they cyber threat actors have a chance to exploit them.
Click here for more information on reducing Internet exposure.