The water utilities sector is becoming more connected, but its identity security needs to catch up

Australia's water utilities are becoming increasingly digital. Smart meters, remote sensors, cloud-based analytics and connected operational systems are improving how water is monitored, treated and delivered. These investments help utilities detect leaks earlier, respond to faults faster and manage infrastructure across vast geographic areas.

However, greater connectivity raises a critical question: who can access these systems and how can water companies be confident that those people are who they claim to be? For an essential service, compromised credentials can have consequences beyond stolen data. Unauthorised access could disrupt treatment or distribution, complicate recovery and undermine public confidence.

Connectivity changes the risk

Water environments combine modern cloud applications with operational technology (OT) designed to operate reliably for decades. Older systems may not support contemporary authentication methods, while remote access arrangements established years ago may rarely be reviewed. This creates an expanding identity security challenge at the boundary between information technology (IT) and OT.

A compromised login is an operational risk

The Australian Signals Directorate's 2023–24 Annual Cyber Threat Report highlighted threats to water and wastewater systems, including compromised passwords, phishing, exposed systems and supply chain weaknesses. It also described international incidents involving unauthorised access to industrial control systems and manipulation of water infrastructure. An attack may begin with a convincing phishing email sent to a contractor, reused credentials or a poorly protected remote management account.

If the compromised identity has privileged access, an intruder may reach sensitive environments, particularly where network boundaries are weak. Even without controlling treatment processes, disruption to scheduling, communications or maintenance can affect service delivery. Identity protection must therefore be treated as an operational resilience issue rather than solely a corporate IT responsibility.

Not all authentication provides equal protection

Multi-factor authentication (MFA) is an established security measure, but the method matters. SMS codes, one-time passwords and some push notifications remain vulnerable to phishing and social engineering. An employee can complete an MFA challenge and unknowingly authorise an attacker's login. Phishing-resistant authentication reduces this risk by binding authentication to the legitimate service.

FIDO2 security keys and passkeys use cryptographic authentication that prevents credentials captured through fraudulent websites from being used to impersonate users. Hardware-backed security keys, such as the YubiKey, are particularly relevant for administrators, engineers, control-room personnel and external specialists accessing sensitive systems. They also work without mobile reception, which can be unreliable at some remote water treatment facilities. 

The Australian Signals Directorate's (ASD) ASD Essentials, formerly the Essential Eight, explicitly calls for phishing-resistant MFA when users authenticate to systems, including from untrusted, external or high-risk locations

Stronger authentication is not a substitute for network segmentation or secure system design. Legacy industrial controllers cannot always support it directly, so utilities should secure the pathways into these environments, including remote access gateways, engineering workstations and privileged-access systems.

Securing access across a distributed workforce

Water utilities depend on employees, engineering contractors, technology vendors and maintenance providers who may need occasional access across multiple facilities. Organisations need to know which accounts can reach operationally significant systems, what permissions they hold and whether those permissions remain appropriate. 

Privileged accounts and remote connections should use phishing-resistant MFA, while external access should be approved for defined tasks, monitored and removed when no longer required.

Shared accounts make accountability difficult. Where legacy systems require them, utilities should introduce individual authentication and activity monitoring through controlled access gateways. They must also plan for emergencies: backup authentication methods, spare security keys and tested emergency-access procedures can help authorised engineers respond without weakening normal controls. Machine identities, service accounts and connected devices also need appropriate credential management.

Identity security is becoming a governance obligation

Australia's Security of Critical Infrastructure Act 2018 places risk-management and cyber incident reporting obligations on operators of relevant critical water assets. These requirements reinforce the need to manage vulnerabilities and third-party dependencies, but compliance alone does not demonstrate resilience. Boards should understand whether strong identity controls extend across IT and OT access pathways and whether contractors meet appropriate authentication standards.

Executives should also ask how quickly privileged access can be revoked and whether essential services can continue if credentials are compromised or remote access becomes unavailable. These are operational risk and governance questions, not simply technical matters for cybersecurity teams.

Protecting the future of connected water infrastructure

Australia's water utilities will continue investing in digital infrastructure to improve efficiency, reduce waste and respond to demand. As more people and systems gain access, protecting identities becomes increasingly important. Phishing-resistant authentication, supported by strong access governance and OT security controls, reduces opportunities to exploit stolen credentials. For water utilities, identity security is not just about protecting information. It is fundamental to maintaining the safety, reliability and resilience of an essential service.