Attackers are lazy in the most practical way. They don't pick the hardest way in. They pick the easiest one. In a water system, the easy ways in tend to be the same five doors. These are the five, and how to shut each one.
Door one: the screen on the internet. An operator screen that anyone can reach from anywhere. It was set up for convenience, years ago, and nobody remembers it's out there. The answer: find every screen and controller that can be reached from outside, and take them off the open internet. If someone needs remote access, give them a locked, watched way in.
Door two: the factory password. The login the device shipped with, or one password shared across every site. The answer: a unique login on every device, changed when people leave, and an alert when someone keeps guessing.
Door three: the vendor who never left. The company that installed your controls kept a permanent connection to fix things from afar. Handy. Also open all night, every night. The answer: see every vendor session as it happens, allow it only when you've approved it, and close it when the work is done.
Door four: the radio at the remote site. Cellular modems and radio links connect the far-off sites. Many of them skip your network completely, so your network tools never see them. The answer: treat the airwaves as part of your network, and watch them the same way.
Door five: the fix nobody checked. This one surprises people. Your team changes a password or blocks a connection. The attacker is out. But nobody checked whether the alarm still reports or the tank level still reaches the screen. Next week, the tank overflows and nobody hears about it. The answer: every fix gets two checks. Is the door closed? And does the equipment still do its job?
Look at the five answers together and you'll see a pattern. See every device. Prove which ones put the water at risk. Control them quickly, with a person in charge and proof that the security and the service both work. That's the method. The next three chapters show how.
View the five doors and See, Prove, Control diagrams in the PDF.