The Pipe · The Bulkhead 00
The Drainage Gate at Helm's Deep: The Pipe That Destroys the Perimeter
Every system needs drainage. The breach does not come through the wall. It comes through the thing the wall needed in order to work.
Written by Scot Free
In The Two Towers, the defenders of Helm's Deep have the best wall in the story. It is tall, it is thick, and every eye in the fortress is on it. The attackers do not beat it. They carry a torch to a culvert at its base, packed with black powder, and blow a hole in the one place nobody was watching.
The culvert is a drain. It exists because a fortress has to shed water, and a fortress that cannot will rot from its own plumbing. Nobody designed it as a weakness. It was doing its job right up until the moment it was not.
What happened next is the part worth remembering. The defenders fell back to the keep. The wall was gone and the fortress was not.
You cannot build a working system without drainage, so the pipe will always exist. The failure is believing the wall makes the pipe immune, and having nothing behind the pipe when it goes.
Every system has a culvert
A system has to move something out: data, heat, power, waste. In industrial IoT, SCADA, and satellite ground networks, that movement runs through unglamorous infrastructure. A pump station's telemetry link. A sensor on a cellular modem in a basement. A maintenance connection a third party uses to push updates.
The common blind spot, and this is my observation rather than a proven rule, is that organizations spend their attention on the cloud lakehouse and the central model, and a fraction of it on those links. Three cases, one current and two older, show what the culvert looks like when it is used.
Culvert one: a cellular modem
On July 30, 2026, the FBI and EPA issued a joint public service announcement: since July 27, water and wastewater utilities in at least seven states had reported incidents, and some of them had degraded operations. According to the FBI, the attackers reached exposed controllers remotely and changed their IP addresses and passwords. At least one utility noticed because the ladder logic on several of its sites no longer matched. The agency's own warning about the physical consequence was plain: a loss of pressure can let untreated groundwater seep into the pipes.
CISA's broader advisory on this family of activity, AA26-097A, first issued April 7 and revised July 22, describes the method. The attackers connect with legitimate engineering software, the way an authorized technician would. Then they alter project files, manipulate what operators see on their HMI and SCADA screens, and disable alarm and shutdown logic. CISA's own Internet Exposure Reduction Guidance, revised August 21, adds the detail that matters for this site: in July, CISA observed malicious activity targeting internet-exposed systems at more than 100 water and wastewater entities, commonly PLCs connected directly to a cellular modem. That is a count of entities targeted, not confirmed compromises.
That is the culvert. Not the lakehouse, not the model, not the security operations center. A controller on a cellular link with a reachable address. It is the same layer covered in Subterranean Telemetry, and nobody designed it to be an entry point. It was designed to carry pump data.
On the ground, it looked like this. In Clayton County, Georgia, a pump station failed around 1 a.m. on July 27, and some customers on a system serving more than 250,000 people had low pressure or no water. The authority issued a precautionary boil-water advisory, had pressure back by about 4 a.m., and lifted the advisory on July 28 after testing showed the water was safe. The authority says unauthorized cyber activity may have been involved, and the investigation continues. A utility representative reportedly told a local TV station that its PLCs may have been vulnerable because they were exposed to the internet.
In Colorado, the governor's office disclosed on September 18 that foreign actors had breached two small private water utilities in late August, each serving fewer than 200 people. The intruders changed equipment settings, disabled remote access and alarms, and altered pumping cycles before operators regained control. The state says treatment and water quality were not affected, as far as it knows. The public record does not say how long the intruders were in before anyone noticed.
One note on attribution, because it matters. The April advisory attributes the PLC exploitation it documents to Iranian-affiliated actors. The July FBI/EPA announcement named no one. Later coverage describing the July activity as suspected Iranian is reporting, not part of that announcement. Keep the sources separate.
Culvert two: a vendor login
In March 2014, Target's CFO told the Senate Commerce Committee that the intruders had likely first obtained an HVAC vendor's credentials to reach the outermost part of the company's network. Early press reports said that vendor's access was for monitoring building systems. The committee staff's own analysis describes access for electronic billing, contract submission, and project management. Accounts differ on the mechanism. They agree on the result: the attackers moved from the vendor-facing edge into systems holding payment data and put malware on the point-of-sale terminals, exposing about 40 million payment cards.
The staff report noted that requiring two-factor authentication from that vendor could potentially have disrupted the attack.
The vendor's credential reached further than the vendor's job. That is the whole story.
Culvert three: a forgotten account and a business dependency
The way into Colonial Pipeline in 2021 was a legacy VPN account protected by a password and nothing else. The earliest sign of the intruders was April 29. The ransomware landed May 7, so they had been inside for at least eight days before anyone knew.
The ransomware hit Colonial's IT and billing systems. The pipeline control systems were not encrypted. Colonial shut down about 5,500 miles of pipeline anyway, as a precaution, and restarted on May 12.
Whether the network segmentation held is argued in the post-mortems, and I will not settle it here. The lesson that survives the argument is the one a network diagram misses: the blast radius ran through the billing system. A company that cannot invoice cannot safely operate, so a breach of the business side became a shutdown of the physical side. The bulkhead has to exist in the business process as well as the network.
The scorecard
Every post in this series reports four numbers: how far it reached, how long until someone saw it, how long until it was contained, how long until the system came back.
| Case | Blast radius | Time to detect | Time to contain | Time to restore |
|---|---|---|---|---|
| Water utilities, July 2026 (campaign) | Exposed PLCs and HMI/SCADA displays; some operations degraded; 100+ water-sector entities targeted (CISA) | Not disclosed in aggregate; one utility caught it through mismatched ladder logic | Agency guidance: take devices off the public internet | Not disclosed |
| Clayton County Water Authority, Georgia, July 27, 2026 | Pump station and part of its operational systems; low pressure or no water for some customers; precautionary boil-water advisory; system serves 250,000+ people | Pump station failure around 1 a.m.; cyber cause still under investigation | Not stated in the sources reviewed | Pressure back by about 4 a.m. (about three hours); advisory lifted July 28 after testing |
| Target, 2013 | About 40 million payment cards; malware on point-of-sale systems | Card theft window Nov 27 to Dec 18; public disclosure Dec 19 | Not stated in the sources reviewed | Not stated; remediation announced: more segmentation, chip-enabled cards by early 2015 |
| Colonial Pipeline, 2021 | IT and billing systems encrypted; about 5,500 miles of pipeline halted | At least 8 days, first access Apr 29 to ransomware May 7 | Same day: pipeline halted May 7 | Restarted May 12; normal operations reported May 15 |
Public records rarely give all four, and a blank cell does not prove the organization did not know. It does mean nobody outside can check. A plant that has never written its own four numbers down is guessing.
Where the bulkhead goes
Three questions for any pipe, asked while the drawing is still on the table:
- What can this credential reach? If the honest answer is "the network," the pipe has no bulkhead. A vendor's login should reach the vendor's job and nothing else. CISA's August guidance now tells operators to find out which integrators and vendors hold remote access through VPN credentials or cellular modems.
- Who sees the traffic on this pipe, and how fast? Eight days of dwell time is not a security failure so much as a measurement failure.
- What does the business do if we cut it? Colonial could contain the breach by stopping. The cost of stopping was the real blast radius, and nobody had priced it.
None of this is new. Zero trust (NIST SP 800-207) starts from the assumption of breach, and IEC 62443 draws industrial networks into zones and conduits so that one compromised segment stays one segment. What is rare is a design review that asks the questions out loud and writes the four numbers down.
The Underground Take
Eleven years in audit management taught me that the first draft of a finding almost always names the thing everybody was already watching. The perimeter failed. The vendor failed. Somebody missed a patch. It is rarely the real finding, because a wall is something you can point at, and the real finding is usually a diagram nobody drew.
Look at what the three cases above share. The way in was ordinary every time: a controller on a cellular modem facing the open internet, a vendor login that reached further than the vendor's job, a legacy account nobody remembered. The wall was not the story. The pipe was, and the pipe was supposed to be there.
I ran nine connected-device programs. They were Radio Shack boxed lab experiments, and none of them died of a breach. That is not a security record, it is a survivorship record: six never reached the field, and three died on physics before anyone had a reason to attack them. Here is what bothers me now. A controller on a cellular modem with a reachable address is the same shape as one of those boxes. The architecture does not change with the price tag. What changes is what sits on the other end of the pipe: a weather reading for me, a water pump for those utilities. The box does not set the blast radius. What it is wired to does.
Deming's version of this is plain enough. You cannot inspect quality into a product at the end, and you cannot inspect security into a pipe after the breach. You decide where the breach stops while the drawing is still on the table, and you measure it like any other process: how far it reached, how fast you saw it, how fast you contained it, how fast you came back.
The wall is a promise. The bulkhead is a plan.
This is the first post in The Bulkhead, a recurring look at how connected systems get breached and how they recover. Each one reports the same four numbers. Failure modes and defenses only; never a how-to.
Sources
- FBI and EPA, joint Public Service Announcement on malicious cyber actors targeting internet-facing PLCs in the water and wastewater sector (Alert I-073026-PSA), July 30, 2026.
- CISA, FBI, NSA, EPA, DOE and partners, joint advisory AA26-097A, first published April 7, 2026, updated July 22, 2026.
- CISA, Internet Exposure Reduction Guidance, revision date August 21, 2026 (cisa.gov). The "more than 100 Water and Wastewater Systems Sector entities" language is from the page text as retrieved in October 2026. Some press coverage quoted the figure as "over 100 internet-exposed systems."
- Clayton County Water Authority statements and local coverage (WSB-TV Atlanta, Georgia Recorder, CBS News Atlanta, Atlanta Journal-Constitution), July 27 to August 4, 2026. Population served is reported as more than 250,000 (AJC) and about 300,000 (other outlets). The PLC-exposure remark is as reported by a local TV station.
- Colorado governor's office statement of September 18, 2026, as reported by The Denver Post, Axios Denver, and Fox News.
- Testimony of John Mulligan, Target, before the Senate Committee on Commerce, Science, and Transportation, March 26, 2014. Committee staff, "A 'Kill Chain' Analysis of the 2013 Target Data Breach," March 2014. Early press accounts of the vendor's access (Krebs on Security; Computerworld, February 2014) differ from the staff report on the mechanism.
- Colonial Pipeline: CISA and FBI joint advisory AA21-131A (May 2021); testimony of Joseph Blount before the Senate Homeland Security and Governmental Affairs Committee (June 2021); timeline and first-access date as compiled by Sophos and other incident reviews. Accounts differ on how well IT/OT segmentation held.
- NIST SP 800-207, Zero Trust Architecture; IEC 62443 series on industrial automation and control system security.
- Film reference: The Lord of the Rings: The Two Towers (2002), the Helm's Deep sequence, paraphrased.
The cellular layer these controllers run on is covered in Subterranean Telemetry. The career side of securing these systems runs at TheMoneyZoo.
Corrections and field data: Scott@IoTunderground.com
