Key takeaways
Viral footage of people entering New York City’s sewers at night has security experts pointing to a familiar weakness: infrastructure that is hard to physically monitor is usually digitally under-defended too.
For remote sites like solar farms and wind installations, an unwatched gate or cabinet can become a bridge into critical systems if the network behind it is not properly segmented.
This post looks at what the sewer story reveals about lateral movement risk, and how network segmentation and resilient connectivity close that gap.
As reported by the Security Magazine, security cameras in Queens and Brooklyn caught something nobody could quite explain in June: small groups of people, some with headlamps and shovels, climbing out of street maintenance holes in the middle of the night. One group stayed underground for roughly three hours before resurfacing, changing into fresh clothes by parked cars, and disappearing. New York City’s Department of Environmental Protection inspected the sewer system afterwards and found no physical damage. Investigators still don’t know exactly who these people were or why they were down there.
It’s a strange story, and it made headlines for that reason. But underneath the strangeness, several security leaders quoted in the coverage pointed to a much more familiar problem, one that has nothing to do with sewers and everything to do with the remote sites our customers run every day.
The real lesson: physical blind spots are digital blind spots
The commentary from cybersecurity specialists following the story kept circling back to the same point. Infrastructure that is physically hard to monitor is very often digitally under-defended too. A sewer system, like a lot of critical infrastructure, relies on ageing sensors and control networks that were never designed with today’s threats in mind. And where those networks are interconnected, whether that’s sewer monitoring sharing architecture with water treatment, or a solar site’s CCTV sharing a switch with its SCADA system, a way in at the physical edge can become a way in everywhere else.
That is the concept of lateral movement, and it is not unique to municipal utilities. It is exactly the risk we talk to installers, ARCs, and infrastructure operators about every day.
Why this matters for solar, wind, and critical infrastructure sites
Think about a typical remote site: a solar farm, a wind installation, a roadside comms cabinet. The physical access points, a perimeter gate, an unmanned equipment cabinet, are rarely watched in real time. Nobody is stationed there around the clock, and a single camera pointed at a gate does not stop someone from reaching the switch behind it.
The danger is what happens if that switch is not properly segmented. If your CCTV system, your SCADA network, and your general site connectivity all sit on the same flat network with no separation, then a single compromised device, a camera, an NVR, even a forgotten piece of kit left plugged in, can become the bridge into the systems that actually run your operation. The physical entry point was never the real target. It was just the way in.
Segmentation is what stops the bridge being built
This is precisely the gap our Dual Static IP feature on i-ctrl is designed to close. Rather than one flat network trying to do everything, a site can run two independent, isolated public IPs on the same device, one for CCTV, one for SCADA or another critical system. Each behaves as its own accessible endpoint. If one side is compromised, there is no open path for an attacker to move laterally into the other. It is complete network segmentation without the cost or complexity of separate hardware, separate subnets, or a second connectivity contract.
- Logical separation between CCTV and operational systems, even on shared infrastructure
- No shared tenant access, and no reliance on a single flat LAN to keep everything reachable
- Automatic failover between Starlink and 5G/4G, so segmentation does not come at the cost of resilience
- Easier alignment with compliance and tender requirements for critical infrastructure operators
Real-time connectivity is what makes real-time monitoring possible
One other observation from the coverage is worth sitting with. A security specialist commenting on the story made the point that footage reviewed days after an event is not security, it is archaeology. Cameras only earn their keep if someone, or something, can act on what they see while there is still time to respond.
That is only possible with a connectivity path that is actually there when it is needed. A remote site with patchy, unreliable connectivity cannot support real-time monitoring no matter how good its cameras are. This is the other half of what Netcelero solves: a resilient, always-on communications path over 4G, 5G, fibre, or Starlink, so that whatever is watching your site, whether that is an ARC, an on-site team, or an AI-driven monitoring platform, has a live view to act on, not just a recording to review afterwards.
The takeaway
Nobody expected the story of the summer to come out of a sewer. But the underlying lesson translates directly to the sites our customers protect every day: the parts of your infrastructure that are hardest to physically watch are usually the parts most at risk of being digitally under-defended. Segmenting your networks and keeping your connectivity resilient are not separate projects, they are two halves of the same defence.
If you would like to talk through how Dual Static IP or Secure Link could apply to your site, get in touch with the Netcelero team.
