When Cyber Systems Go Down: Why Physical Security Becomes a Water Utility's Last Line of Defense

When Cyber Systems Go Down: Why Physical Security Becomes a Water Utility's Last Line of Defense

The coordinated cyberattack that hit more than 30 Minnesota water systems in late July was initially a cybersecurity story. Within days, it became something larger.

Similar attacks were reported across multiple states, and on August 19, federal agencies issued another warning that attackers were actively targeting Siemens S7 programmable logic controllers used throughout water, energy, manufacturing, and other critical infrastructure.

But one of the most important lessons from the Minnesota incidents had very little to do with malware.

When automated systems were disrupted, utilities still had physical infrastructure to operate.

Pumps still had to run. Water towers still had to function. Treatment equipment still had to be monitored. Remote sites still had to be accessed.

That is where cyber resilience and physical security meet.

Cybersecurity Protects the Controls. Physical Security Protects What They Control.

Minnesota officials said most confirmed incidents involved technology used to remotely monitor and control water-system equipment. Some communities experienced disruptions significant enough that operators had to rely on alternate or manual methods while systems were restored.

That distinction matters.

A cyberattack may begin remotely, but the infrastructure being affected is physical: pump stations, treatment facilities, reservoirs, water towers, wells, lift stations, valve sites, and storage facilities. Many of those assets are geographically dispersed, lightly staffed, or completely unmanned.

During normal operation, remote monitoring helps utilities manage that footprint efficiently. During a technology outage, however, operators may suddenly become more dependent on physical access and direct observation.

That creates a question utilities should be asking now: If remote visibility disappears, how much visibility remains at the site itself?

A Different Kind of Redundancy

Utilities already understand redundancy. Critical equipment has backups. Communications may have alternate paths. Emergency procedures exist for operating through equipment failures and outages.

Physical security should be approached the same way.

A single fixed camera pointed toward a gate may provide useful evidence after an incident, but it does not necessarily provide situational awareness across an entire remote facility. The security problem gets harder when a site has large or irregular perimeters, multiple approaches, poor lighting, limited connectivity, no overnight personnel, equipment spread across several acres, or vegetation, weather, and terrain that create blind spots.

During a cyber event, severe weather event, communications outage, or other emergency, those weaknesses become more important rather than less.

Detection Matters More Than Recording

Traditional surveillance often begins with the assumption that someone already knows where to look. A camera covers the gate. Another watches a building. Maybe another covers a storage area. But an intruder does not have to enter where the camera is pointed.

Modern perimeter security reverses that model. Instead of asking cameras to constantly watch everything, a detection layer identifies activity first and then directs surveillance resources toward it.

For remote utility infrastructure, RadiusVision can combine technologies such as:

• Radar Detection: Monitors large areas for movement across ground and, where appropriate, aerial approaches.
• PTZ Auto-Tracking: Directs cameras toward detected activity and follows movement across the site.
• Thermal Imaging: Maintains visibility in darkness and difficult environmental conditions where conventional cameras may struggle.
• AI-Assisted Verification: Helps distinguish relevant activity from common nuisance alarms.
• Drone Patrol and Verification: For appropriate sites and deployments, aerial systems can extend visibility beyond the field of view of fixed cameras and rapidly inspect remote portions of a facility.
• Centralized Monitoring: Brings alerts and surveillance information together so operators can evaluate events without physically staffing every location.

The objective is not simply to collect more video. It is to know when something is happening, where it is happening, and whether someone needs to respond.

Cyber and Physical Security Are Not Separate Problems

The Minnesota attacks are another reminder that critical infrastructure resilience cannot be built in silos. Cyber teams protect networks, controllers, credentials, and communications. Operations teams keep infrastructure functioning. Physical security protects the sites, equipment, and personnel that make those systems real.

A failure in one area can quickly increase dependence on the others.

That is particularly important for smaller municipal utilities. The United States has an enormous number of geographically distributed water systems, many operating with limited staffing and security resources. A sophisticated security operations center at every pump station is neither practical nor necessary.

What is practical is designing security around the way these facilities actually operate — using intelligent detection to cover a remote perimeter, automatically directing cameras toward suspicious activity, providing remote verification, and escalating only the events that require human attention.

Resilience Means Being Able to Operate When Something Else Fails

The lesson from Minnesota should not be that every water utility needs to prepare for one specific hacker or one specific attack method. The larger lesson is that infrastructure resilience depends on layers.

Cybersecurity is one layer. Operational redundancy is another. Physical security is another.

When automated systems become unavailable, the physical facility does not disappear. In many cases, it becomes even more important.

Utilities investing heavily in cyber resilience should ask one additional question: If our digital visibility disappeared tonight, how confident would we be in what was happening at our remote sites?

That is the physical security gap worth closing.

Want to evaluate that gap across your water infrastructure? Schedule a Free Security Consultation with RadiusVision to discuss remote-site detection, radar, thermal surveillance, and drone-enabled security.