A programmable logic controller (PLC) is an industrial computer that runs stored instructions to monitor connected equipment and control its operation. In a water utility, a PLC might read a sensor and operate a pump according to the system’s programmed logic. Because it helps manage a physical process, unauthorized access could interfere with operations—not automatically make water unsafe, but create a risk utilities need to manage.
What a PLC does
NIST defines a PLC as “a solid-state control system that has a user-programmable memory for storing instructions” for functions including input/output control, logic, timing, counting, communications, and data processing. In plain language, it repeatedly receives signals from connected devices, applies its programmed instructions, and changes outputs. What it controls depends on the specific installation. NIST’s glossary definition is based on NIST SP 800-82 Rev. 3 and related publications.
For example, a utility’s control logic could use a level sensor’s reading when deciding whether to run a pump. The PLC is the controller in that arrangement; it is not the sensor or the pump itself.
PLC, HMI, and SCADA: different roles
| Term | Role |
|---|---|
| PLC | Runs programmed control logic and communicates with connected input and output devices. |
| HMI | Human-machine interface: an operator-facing display and means of interacting with a process or equipment. |
| SCADA | Supervisory control and data acquisition: a system for supervising and collecting data from processes, often across multiple control devices. |
These terms are not interchangeable. Some equipment combines PLC and HMI functions in one unit; Unitronics’ Vision700 product page is an example. A product example does not establish that this specific model was involved in a reported incident.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- -- PLC Type: Fully compatible with FX1S, 7 Input 5 Relay Output (24V pulse single). Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3/7.0 (Pls contact us, we will share it and the video instruction and guidelines). For HMI model: pls choose FE Serial, 280D
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
Why PLC security matters in water utilities
Water and wastewater utilities rely on operational technology (OT)—the systems that monitor or control physical processes—as well as conventional information technology (IT). A PLC may be one part of that OT environment, connected to other devices or monitoring and supervisory systems.
The U.S. Environmental Protection Agency advises drinking water and wastewater system owners and operators to assess cybersecurity risks to both IT and OT, identify weaknesses, and plan risk-reduction measures. EPA warns that malicious activity could manipulate vulnerable OT, interfere with operations, and potentially disrupt production of clean and safe water. That is a potential consequence, not evidence that every cyber incident changes water quality or causes an outage. The effects of an intrusion would depend on the utility’s process, architecture, safeguards, and the access obtained. EPA’s water-sector cybersecurity guidance provides the U.S. utility context.
Rank #2
- Weight: 1.00lb
- Product Dimensions: 9.00 x 9.00 x 7.00 inches
- Condition: New
A controller’s network exposure, user accounts, programming logic, and recovery arrangements matter because the device participates in an operational process. Unauthorized access may therefore create risks beyond the loss of office data.
A documented example: internet-connected Unitronics devices
A joint advisory from CISA, the FBI, the NSA, EPA, and international partners says that actors affiliated with Iran’s Islamic Revolutionary Guard Corps, using the CyberAv3ngers persona, began targeting Israeli-made Unitronics Vision Series PLCs and HMIs in November 2023. The advisory says affected devices at water and wastewater facilities and in other sectors were accessed over the internet using default or no passwords. It was originally published December 1, 2023, and revised December 18, 2024. Read the joint advisory and its mitigations.
Rank #3
- -- PLC Type: Fully compatible with FX1S, 10 Transistor Input (NPN Type), 7 Relay Output. Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse, built-in 2AD（0-10V) and 2DA(0-10V), also 2 NTC10K B3435 probe. Just read the address of AD DA NTC's will ok, 2 high speed input 100KHz X0 X1 to control encoder
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3 and Choose FE serial 380 model in HMI software. (Pls contact us, we will share it and the video instruction and guidelines), very easy to use, just create the buttun and set the address
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
The case illustrates why internet exposure and weak authentication matter. It does not establish that PLCs across the water sector are compromised, or that every affected device caused a disruption to water service or quality.
Security priorities for utility operators
Federal guidance offers measures utilities can evaluate for their own systems. The right implementation depends on each utility’s equipment, process, and architecture; these recommendations are not a one-size-fits-all engineering design.
Rank #4
- -- PLC Type: Fully compatible with FX1S, 10 Input 7 Relay Output (5V pulse single). Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse; have 2 high speed input 100KHz X0 X1 to control encoder also
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder (Pls dowload from link or contact us, we will share it and the video instruction and guidelines), very easy to use, just create the buttun and set the address
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we shared from link
Reduce exposure and control access
- Remove unnecessary direct public-internet exposure of PLCs and other OT. If remote access is needed, use controlled mechanisms such as a VPN, gateway, proxy, or firewall, and apply multifactor authentication (MFA) for OT access where applicable.
- Replace default or weak passwords on PLCs and HMIs, and require authentication for access to and changes on field controllers.
- Segment networks with appropriate firewalls and controlled connections so a compromise in one zone does not automatically grant access to control assets elsewhere.
Know the environment and address weaknesses
- Inventory IT and OT assets, noting their purpose, internet exposure, and patch or support status.
- Keep controller firmware and engineering workstation software current according to manufacturer guidance and security advisories relevant to the equipment model. Unitronics’ security page provides manufacturer information; it should complement, not replace, independent guidance.
- Monitor for unusual logins and remote access, as well as unexpected changes to device configurations or control logic.
Prepare to recover and keep practices current
- Back up PLC logic and configurations, and test that recovery arrangements work.
- Develop and exercise incident-response and recovery plans for OT and IT.
- Train staff and periodically reassess cybersecurity practices as threats, technology, and standards change.
A February 21, 2024, CISA, EPA, and FBI fact sheet organizes water-sector actions around reducing public-facing exposure, conducting assessments, changing default passwords, inventorying IT and OT assets, exercising response and recovery plans, backing up systems, reducing vulnerabilities, and training staff. The fact sheet lists the eight action areas. These are dated federal recommendations, not a claim about how many utilities have adopted them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where utilities can start
For a utility, a practical first step is to understand its own control environment: which assets are present, how they communicate, what is exposed, and how access and recovery are managed. EPA recommends recurring risk assessment, while the federal advisory and action materials offer concrete controls to evaluate. Those decisions should account for the actual process and equipment rather than treating all PLCs or water systems as identical.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
