--- title: "Case Study: Small Town Light & Water Department" description: Learn how a security assessment improved email, firewall, Wi-Fi, and SCADA systems for a small town utility. image: https://www.bitlyft.com/hubfs/sebastian-morelli-peyton-DVqdk8MTp2I-unsplash-1.jpg --- [Skip to content](https://www.bitlyft.com/resources/case-study-small-town-light-water-department#main-content) [![BitLyft Cybersecurity](https://www.bitlyft.com/hubfs/BitLyft-header-logo.svg)](https://www.bitlyft.com/) - Solutions Show submenu for Solutions - [BitLyft True MDR](https://www.bitlyft.com/agentic-mdr) Show submenu for BitLyft True MDR - [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) - [Security Automation](https://www.bitlyft.com/security-automation) - [Security Operation Center (SOC)](https://www.bitlyft.com/security-operations-center-soc) - [SIEM Management](https://www.bitlyft.com/security-information-and-event-management-siem) - [Central Threat Intelligence](https://www.bitlyft.com/central-threat-intelligence) - [BitLyft AIR®](https://www.bitlyft.com/air) - Industries Show submenu for Industries - [Banking](https://www.bitlyft.com/cybersecurity-for-banks) - [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) - [DoD (CMMC)](https://www.bitlyft.com/cmmc-cybersecurity-compliance) - [NIST 800 - 171](https://www.bitlyft.com/nist-800-171) - [Healthcare](https://www.bitlyft.com/healthcare-cybersecurity) - [Higher Education](https://www.bitlyft.com/higher-education-cybersecurity) - [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) - [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) - [Energy and Utilities](https://www.bitlyft.com/energy-utilities-cybersecurity) - [Pricing](https://www.bitlyft.com/agentic-managed-detection-response-pricing) - [Partners](https://www.bitlyft.com/partners) - Company Show submenu for Company - [About Us](https://www.bitlyft.com/about-us) - [Careers](https://www.bitlyft.com/careers) - [Contact Us](https://www.bitlyft.com/contact-us) - Resources Show submenu for Resources - [Blog](https://www.bitlyft.com/resources) - [Case Studies](https://www.bitlyft.com/case-studies) - [Downloads](https://www.bitlyft.com/downloads) - [Glossary](https://www.bitlyft.com/glossary-of-terms) - [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) Open main navigation Close main navigation - Solutions Show submenu for Solutions - [BitLyft True MDR](https://www.bitlyft.com/agentic-mdr) Show submenu for BitLyft True MDR - [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) - [Security Automation](https://www.bitlyft.com/security-automation) - [Security Operation Center (SOC)](https://www.bitlyft.com/security-operations-center-soc) - [SIEM Management](https://www.bitlyft.com/security-information-and-event-management-siem) - [Central Threat Intelligence](https://www.bitlyft.com/central-threat-intelligence) - [BitLyft AIR®](https://www.bitlyft.com/air) - Industries Show submenu for Industries - [Banking](https://www.bitlyft.com/cybersecurity-for-banks) - [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) - [DoD (CMMC)](https://www.bitlyft.com/cmmc-cybersecurity-compliance) - [NIST 800 - 171](https://www.bitlyft.com/nist-800-171) - [Healthcare](https://www.bitlyft.com/healthcare-cybersecurity) - [Higher Education](https://www.bitlyft.com/higher-education-cybersecurity) - [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) - [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) - [Energy and Utilities](https://www.bitlyft.com/energy-utilities-cybersecurity) - [Pricing](https://www.bitlyft.com/agentic-managed-detection-response-pricing) - [Partners](https://www.bitlyft.com/partners) - Company Show submenu for Company - [About Us](https://www.bitlyft.com/about-us) - [Careers](https://www.bitlyft.com/careers) - [Contact Us](https://www.bitlyft.com/contact-us) - Resources Show submenu for Resources - [Blog](https://www.bitlyft.com/resources) - [Case Studies](https://www.bitlyft.com/case-studies) - [Downloads](https://www.bitlyft.com/downloads) - [Glossary](https://www.bitlyft.com/glossary-of-terms) - [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) - [Request a Demo](https://www.bitlyft.com/request-a-demo) [Request a Demo](https://www.bitlyft.com/request-a-demo) [All posts](https://www.bitlyft.com/resources/all) October 15, 2024 # Case Study: Small Town Light & Water Department ![](https://www.bitlyft.com/hubfs/sebastian-morelli-peyton-DVqdk8MTp2I-unsplash-1.jpg) ![Picture of Jason Miller](https://www.bitlyft.com/hs-fs/hubfs/Headshots/JasonRound.png?width=50&name=JasonRound.png) By  Jason Miller  ·  3 minute read ## **Background** A public utility in a small municipality, found itself in a unique and potentially compromising situation. The Internet Service Provider (ISP) that served the entire community also played a pivotal role in the utility's operations. This case study explores how our team addressed the cybersecurity challenges of the utility, balancing the technical and political complexities through a thorough security assessment. ## **The Challenge** The primary challenge was twofold: 1. Assess and improve the overall cybersecurity posture of the small town Light & Water Department. 2. Navigate a political landscape where the utility’s ISP had significant influence over its infrastructure, creating unique dependencies and security concerns. ## **Our Approach** Our team conducted a thorough security assessment, which included: - **Internal and External Network Scanning:** We examined vulnerabilities and open ports on both the internal network and public-facing network. - **Firewall Assessment:** Due to limited access to the firewall configuration, this part of the assessment required creative problem-solving and alternative methods - **Email Security Review:** We analyzed their email systems, including subdomains, checking for best practices, multi-factor authentication (MFA) implementation and password policies. - **Endpoint Review:** We validated their End Point Detection and Response (EDR) solution and reviewed patch management lifecycles. - **Access Control Audit:** A review of user access revealed the use of shared credentials, which posed significant security risks. - **SCADA and ICS Review:** Given the critical role of SCADA (Supervisory Control and Data Acquisition) systems in utility operations, we ensured these systems were isolated and secured from potential threats. - **On-site Deployment:** We visited the location and deployed Cylance, a security tool, on key workstations to monitor for any ongoing or potential threats ## **Key Findings** The security assessment revealed several areas for improvement: 1. **Email Security Gaps:** The absence of MFA, insufficient password complexity, and the lack of email security protocols such as DMARC, SPF, and DKIM posed vulnerabilities. 2. **Firewall Control Issues:** The utility did not have access to its firewall configuration, relying solely on the ISP for adjustments, which limited their ability to respond quickly to threats.  3. **Shared Credentials:** The use of a single username and password across multiple users increased the risk of unauthorized access. 4. **Wi-Fi Concerns:** Although the Wi-Fi network was separate from critical systems, there were questions about whether it was sufficiently segmented from the main office network. 5. **SCADA Security:** Encouragingly, the SCADA system was well-secured, with no public access and individualized device accounts. ## **Solutions** The security assessment identified several key areas for improvement, and we implemented the following solutions 1. **Email Security Gaps:** We addressed the vulnerabilities by enabling Multi-Factor Authentication (MFA), enforcing stronger password complexity, and configuring DMARC, SPF, and DKIM to protect against phishing and spoofing. 2. **Firewall Control Issues:** To allow for better control, we worked with the utility to regain access to the firewall configuration, enabling them to make real-time adjustments and respond quickly to potential threats. 3. **Shared Credentials:** We eliminated the use of shared usernames and passwords, replacing them with individual accounts secured by unique, complex passwords, significantly reducing the risk of unauthorized access. 4. **Wi-Fi Concerns:** We ensured proper segmentation between the Wi-Fi and the main office network, securing the Wi-Fi with encryption protocols to prevent unauthorized cross-network communication. 5. **SCADA Security:** While the SCADA system was already well-secured, we reinforced the security by confirming isolated accounts for each device and maintaining strong access controls. **Recommendations** Utilities like the Small Town Light & Water Department often face unique cybersecurity challenges due to their critical infrastructure and limited resources. Here are a few takeaways from this case that can benefit similar organizations: 1. **The Importance of Email Security**: Utilities, like all organizations, are vulnerable to phishing attacks and credential theft. Implementing MFA, strong password policies, and email security protocols (such as DMARC, SPF, and DKIM) can mitigate these risks. 2. **Control Over Critical Infrastructure**: Utilities must have direct access and control over their network devices, including firewalls, to ensure fast response to security threats. Delegating this control to third parties can introduce delays and vulnerabilities. 3. **Minimizing Shared Credentials**: Shared logins expose an organization to higher risks. Each user should have a unique, complex password to prevent unauthorized access. 4. **Segmentation of Networks**: Separating less secure systems (e.g., guest Wi-Fi) from critical infrastructure networks is crucial to avoid inadvertent cross-communication that could expose vulnerabilities. 5. **Ongoing Security Assessments**: Regular reviews of cybersecurity practices and policies are essential to maintain a strong security posture and adapt to evolving threats. ## **Challenges and Outcomes** The project faced several unique challenges: - **Political Sensitivity:** The complex relationship between the utility and its ISP required careful and diplomatic navigation. - **Limited Access:** Inability to access the firewall configuration hindered a complete assessment of the network’s security. Despite these challenges, our team successfully completed the security assessment, providing the Small Town Light & Water Department with a clear picture of their cybersecurity posture and actionable recommendations for improvement. ## **Conclusion** This case study highlights the complex interplay between technology, politics, and security in small-town utilities. The case underscores the importance of ongoing cybersecurity vigilance in utilities of all sizes. Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://www.bitlyft.com/resources/case-study-small-town-light-water-department) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://www.bitlyft.com/resources/case-study-small-town-light-water-department) [twitter icon](https://twitter.com/intent/tweet?url=https://www.bitlyft.com/resources/case-study-small-town-light-water-department) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://www.bitlyft.com/resources/case-study-small-town-light-water-department) [envelope icon](mailto:?body=https://www.bitlyft.com/resources/case-study-small-town-light-water-department) [![Group 1000001766](https://www.bitlyft.com/hubfs/Group%201000001766.svg "Group 1000001766")](https://www.bitlyft.com) [BitLyft AIR®](https://www.bitlyft.com/air) [Agentic MDR](https://www.bitlyft.com/agentic-mdr) [Partner](https://www.bitlyft.com/partners) [Privacy Policy](https://www.bitlyft.com/privacy-policy) [Careers](https://www.bitlyft.com/careers) [Blog](https://www.bitlyft.com/resources) [White Papers ](https://www.bitlyft.com/downloads) [Use Cases](https://www.bitlyft.com/case-studies) [Miller Mindset Podcast](https://www.youtube.com/playlist?list=PLz7CtIA5QhhJgjIo3CUpdm7gm3Th6mrcm) [About Us](https://www.bitlyft.com/about-us) [Contact Us](https://www.bitlyft.com/contact-us) [News](https://www.bitlyft.com/news) [Get A Quote](https://www.bitlyft.com/get-a-quote) [facebook-f icon](https://www.facebook.com/BitLyft) [linkedin-in icon](https://www.linkedin.com/company/bitlyft/) [twitter icon](https://twitter.com/bitlyft) [youtube icon](https://www.youtube.com/channel/UCGMnF3PMXFgTotrnPJfC87w) Copyright © 2026, BitLyft Cybersecurity [![BitLyft Cybersecurity](https://www.bitlyft.com/hubfs/BitLyft-header-logo.svg)](https://www.bitlyft.com) Solutions [FeaturedBitLyft AIR® Autonomous SOC — detection, response & remediation on autopilot, around the clock. Explore the platform](https://www.bitlyft.com/air) Our Solutions [BitLyft Agentic MDRFully managed detection & response](https://www.bitlyft.com/agentic-mdr) [Security AutomationAutomate the busywork of defense](https://www.bitlyft.com/security-automation) [Security Operations Center24/7 SOC coverage](https://www.bitlyft.com/security-operations-center-soc) [SIEM ManagementTuned, managed & monitored](https://www.bitlyft.com/security-information-and-event-management-siem) [Central Threat IntelligenceShared signal across customers](https://www.bitlyft.com/central-threat-intelligence) [BitLyft AIR®Automated incident response](https://www.bitlyft.com/air) [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) [Plans & pricing](https://www.bitlyft.com/pricing) [Compare MDR vs. AIR NEW](https://www.bitlyft.com/true-mdr) Industries [Compliance-readyDoD & CMMC Meet CMMC and NIST 800-171 with security operations built for regulated sectors. See compliance coverage](https://www.bitlyft.com/cmmc) Industries we protect [Banking](https://www.bitlyft.com/banking) [FinTech](https://www.bitlyft.com/managed-detection-and-response-for-fintech) [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) [DoD (CMMC)](https://www.bitlyft.com/cmmc) [NIST 800-171](https://www.bitlyft.com/nist-800-171) [Healthcare](https://www.bitlyft.com/managed-detection-and-response-for-healthcare) [Higher Education](https://www.bitlyft.com/higher-education) [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) [Energy & Utilities](https://www.bitlyft.com/energy-and-utilities) [Pricing](https://www.bitlyft.com/pricing) [Partners](https://www.bitlyft.com/partners) Company [Who we areAbout BitLyft On a mission to make elite cybersecurity accessible to every organization. Our story](https://www.bitlyft.com/about-us) Company [About Us](https://www.bitlyft.com/about-us) [Careers](https://www.bitlyft.com/careers) [Contact Us](https://www.bitlyft.com/contact-us) Resources [LearnBitLyft Blog Threat research, how-to guides and security insights from our SOC team. Read the blog](https://www.bitlyft.com/resources) Resources [Blog](https://www.bitlyft.com/resources) [Newsroom](https://www.bitlyft.com/news) [Case Studies](https://www.bitlyft.com/case-studies) [Downloads](https://www.bitlyft.com/downloads) [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) [Request a Demo](https://www.bitlyft.com/request-a-demo) [Request a Demo](https://www.bitlyft.com/request-a-demo) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jason Miller", "url" : "https://www.bitlyft.com/resources/author/jason-miller" }, "dateModified" : "2024-10-15T19:29:04.986Z", "datePublished" : "2024-10-15T19:29:04.000Z", "headline" : "Case Study: Small Town Light & Water Department", "image" : [ "https://www.bitlyft.com/hubfs/sebastian-morelli-peyton-DVqdk8MTp2I-unsplash-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.bitlyft.com/resources/case-study-small-town-light-water-department", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.bitlyft.com/hubfs/BitLyft%20Logo%20(New)/BLLogo.svg" }, "name" : "BitLyft" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "Jason Miller" ] }, "datePublished" : "2024-10-15T19:29:04+0000", "description" : "Learn how a security assessment improved email, firewall, Wi-Fi, and SCADA systems for a small town utility.", "headline" : "Case Study: Small Town Light & Water Department", "image" : "https://www.bitlyft.com/hubfs/sebastian-morelli-peyton-DVqdk8MTp2I-unsplash-1.jpg", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.bitlyft.com/hubfs/BitLyft%20Logo%20(New)/BLLogo.svg" }, "name" : "BitLyft Cybersecurity" }, "url" : "https://www.bitlyft.com/resources/case-study-small-town-light-water-department" } ```