The incident should be read as an authority problem
The 2021 attempted compromise of the Oldsmar water treatment plant remains a useful case because the FBI has released investigative records and the event focused attention on remote access to operational systems. Debate about precise attribution does not remove the architectural lesson.
Remote-support tools are often deployed because small utilities and industrial sites need vendors or staff to troubleshoot systems quickly. The risk appears when that convenience becomes standing authority: persistent credentials, unattended remote software, broad access and weak separation between the support session and the physical process.
In that model, the plant is effectively assuming that anyone who reaches the remote-access channel is still the person and device originally intended. That is a stronger trust assumption than most organisations would knowingly accept.
The case is useful because remote-access authority reached process-control functions; the broader lesson is to constrain standing authority even when access appears legitimate.
Does remote authority disappear automatically when the operational work that justified it ends?
Access should expire with the work
NIST SP 800-82 recommends controls tailored to OT availability and safety constraints, including segmentation and managed remote access. The strongest implementation links digital access to an operational state that can be independently verified.
A maintenance session should have a named owner, target asset, approved time window and clear termination condition. When the work order closes, the authority should disappear. When operator approval is required, the network path should not be able to silently outlive that approval.
This reduces the blast radius of stolen credentials and creates better forensic evidence. The question after an incident becomes which authorised session existed and what it did, rather than whether a generic remote account might have been used at some point.
- Disable unattended remote tools that are not operationally required.
- Use individual identities and MFA at the mediation point.
- Tie access windows to approved maintenance work.
- Record sessions that can alter process state.
- Verify access revocation as part of work closure.