Cloud Cybersecurity: How HTTPS Encryption Protects Your Environmental Laboratory's Data

Key facts

The Monday a water laboratory’s system stopped responding

On 21 April 2025, Aigües de Mataró—the utility that manages water supply for this Catalan municipality—detected that its IT systems and website had stopped working normally. It wasn’t a technical failure: it was a cyberattack.

The company activated its containment protocols quickly. Drinking water supply, wastewater management, and the urban district heating and cooling network kept operating without interruption—a sign that segmentation between IT systems and operational technology (OT) had worked as a containment barrier. But the attack did compromise customers’ personal data: names, ID numbers, dates of birth, postal addresses, emails, phone numbers, tenancy status, bank details (IBAN), and even meter-reading and vulnerability-related information.

This incident is not an isolated exception. It’s evidence that the IT systems of a water utility—and, by extension, the laboratories that analyze its samples—are now a real target for cybercriminals.

Why an environmental laboratory is a target, even if it doesn’t feel like one

It’s tempting to assume a water-testing laboratory has nothing an attacker would want. The reality is different: an environmental LIMS concentrates at least three types of data that do hold value for a cybercriminal, or that are simply subject to strict legal protection obligations.

Personal data of clients and technical staff: Names, addresses, and contact and billing details for every client, subject to data protection regulations such as the EU’s General Data Protection Regulation (GDPR) or equivalent national laws elsewhere.

Analytical results with legal value: Certificates of analysis that serve as evidence in accreditation audits, litigation, administrative sanctions, or notifications to regulatory bodies. Their alteration or loss has consequences that go far beyond IT.

Information tied to critical infrastructure: Sampling points, water treatment plants, wastewater facilities, and distribution networks whose location and status, in the wrong hands, could facilitate attacks on the water cycle’s physical infrastructure.

Available data puts the risk in perspective without downplaying it. According to the European Repository of Cyber Incidents (EuRepoC), only 18 of the 965 cyberattacks reported in Europe between 2000 and 2023 were linked to the water sector—still a minority risk compared to sectors like finance or energy. But the trend is upward. National cybersecurity agencies have documented a substantial rise in reported incidents in recent years, and analysts consistently note that the entry vectors compromising water infrastructure are rarely sophisticated: systems exposed directly to the internet and unchanged default credentials—issues detectable even with free tools.

The most widely cited international case—the water treatment plant in Oldsmar, Florida, where unauthorized remote access briefly allowed an attacker to alter the concentration of sodium hydroxide in the water—didn’t involve a LIMS at all, but an industrial control system (SCADA). The distinction matters: a LIMS manages information, not valves or pumps. But the entry vector—poorly protected remote access, weak passwords, outdated software—is exactly the same type of vulnerability that any cloud platform, including a LIMS, needs to close.

What does the HTTPS padlock actually protect?

HTTPS (HyperText Transfer Protocol Secure) is the standard web protocol, HTTP, encrypted using TLS (Transport Layer Security). In practical terms, it means that when a lab technician opens Zendo LIMS in a browser to enter a result, the information traveling between their computer and the server is encrypted end to end: even if someone intercepts that traffic—on a public Wi-Fi network, for example—all they would see is unreadable data.

SSL and TLS: the most common mix-up

It’s common to hear “SSL certificate” used to describe a website’s security, even though the term is technically outdated. SSL (Secure Sockets Layer) was the original protocol, but its versions became obsolete due to known vulnerabilities and were replaced by TLS more than two decades ago; modern browsers today run on TLS 1.2 or TLS 1.3. The name “SSL” has survived in everyday commercial language, but what actually protects a LIMS connection in 2026 is TLS.

Encryption in transit versus encryption at rest

HTTPS/TLS protects data while it travels across the network: that’s encryption in transit. But data also needs protection once it reaches its destination and is stored in the server’s database: that’s encryption at rest. A LIMS that only encrypts the connection but stores results as plain text on the server leaves a door open if an attacker gains direct access to the database. Combining both layers—transit and rest—is what guarantees a result’s confidentiality from the instrument all the way to the final report.

Encryption layer	What it protects	Threat it mitigates
Encryption in transit (HTTPS/TLS)	Data while it is transmitted between the browser and the server	Interception on public or shared networks (“man in the middle”)
Encryption at rest	Data stored in the database and in backups	Direct unauthorized access to the server or a stolen backup
End-to-end encryption	Data confidentiality across its entire lifecycle in the system	Exposure of sensitive results at any point in the chain

The seven security layers any cloud LIMS should have

HTTPS is the front door, not the whole building. An environmental LIMS that safeguards client data, legally significant results, and critical infrastructure information needs several security layers working together. Here’s what’s worth demanding—and what Zendo LIMS already implements—beyond connection encryption.

Encryption in transit and at rest: HTTPS/TLS for communications, plus encryption of the database and its backups.

Multi-factor authentication (MFA): A second verification factor—a temporary code, an authenticator app—that blocks access even if a password is compromised.

Role-based access control: Each user sees and edits only what their role requires. We cover this in depth in the next article in this series.

IP range restriction: Limiting system access to the laboratory’s or its sites’ authorized networks, closing the door to access from unrecognized locations.

Automated backups: Regular, encrypted backups that ensure no result is lost to a technical failure, human error, or ransomware attack.

Tamper-proof audit trail: A record of who did what and when—a requirement already covered in this series’ Quality, ISO, and Regulatory Compliance block.

Digital signature of reports: Assurance that a certificate of analysis has not been altered after issuance, with legal standing against third parties.

The regulatory landscape already shaping—or about to shape—your laboratory

Laboratory cybersecurity isn’t just a technical matter: across the EU and other regions, it’s increasingly regulated, and several frameworks now overlap.

Data protection law: the foundation

Regulations such as the EU’s General Data Protection Regulation (GDPR)—or equivalent national data protection laws in other jurisdictions—require any laboratory that processes client or employee data, which is practically all of them, to apply technical and organizational measures proportionate to risk: encryption, access control, the ability to restore data availability after an incident, and breach notification to the relevant data protection authority when required.

National and sector-specific security frameworks

Beyond general data protection law, many countries maintain their own mandatory cybersecurity frameworks for public administrations and their service providers—Spain’s National Security Framework (Esquema Nacional de Seguridad) is one example, and similar reference frameworks exist elsewhere, such as the NIST Cybersecurity Framework in the US or ISO/IEC 27001 as an international baseline. For laboratories that work with municipalities, water authorities, or other public bodies, these frameworks typically set additional reference levels—often categorized by risk into basic, moderate, and high tiers—worth factoring into a security roadmap.

NIS2: water as a high-criticality sector

The EU’s Directive 2022/2555, known as NIS2, replaces the previous cybersecurity directive and significantly widens its scope. It explicitly includes drinking water and wastewater among the European Union’s high-criticality sectors, alongside energy, transport, health, and digital infrastructure. Its core obligations—risk management, incident notification, encryption, access control and, where applicable, multi-factor authentication—have applied at EU level since December 2022.

Several member states, including Spain, have yet to complete national transposition; the European Commission referred related delays to the Court of Justice of the EU in mid-2026. This doesn’t mean water utilities and their suppliers are off the hook: the market, public administrations, and auditors already treat NIS2 as a de facto reference, and laboratories that work with water operators anywhere in the EU should get ahead of it rather than wait for national legislation to catch up. Outside the EU, comparable pressure is building too—for example, US water utilities face growing federal cybersecurity expectations, and the UK’s NIS Regulations impose similar obligations on operators of essential services.

ISO/IEC 17025:2025 and data management

The new edition of the laboratory accreditation standard, published on 27 September 2025, incorporates specific provisions on information technology for the first time: updated vocabulary and requirements for LIMS, networked instrumentation, and automated data pipelines. Secure information management is no longer an implicit best practice—it’s now an explicit element of the technical competence that accreditation bodies evaluate.

How Zendo LIMS protects your laboratory’s data

Zendo LIMS applies these security layers natively, without requiring the laboratory to manage its own infrastructure:

End-to-end encryption: Data is protected from the moment it’s generated until it’s stored in the cloud.

Multi-factor authentication (2-step verification): Can be enabled to strengthen each user’s access.

IP range access control: Configurable at global or per-user level, useful for multi-site laboratories.

Inactivity lockout: Automatic session closure after a period of inactivity, preventing unattended open sessions.

Periodic backups: Automated backups on Zendo LIMS servers to ensure information can be recovered from any unexpected event.

Role-based permissions: Each user accesses only the information and functions their role in the laboratory requires.

EU-based hosting: Data centers located in the European Union, aligned with GDPR requirements.

These layers don’t replace the laboratory’s own good practices—password hygiene, staff training, periodic permission reviews—but they remove the part of the equation that causes the most incidents according to national cybersecurity agencies: exposed systems with no basic protection and unchanged default credentials.

Frequently asked questions

What’s the difference between HTTP and HTTPS?

HTTP transmits data unencrypted; anyone who intercepts the connection can read it. HTTPS adds a layer of TLS encryption that makes that data unreadable to third parties. A LIMS that handles analytical results and personal data should always run under HTTPS, never HTTP.

Are an SSL certificate and TLS the same thing?

In everyday commercial usage, yes, but technically no. SSL is the original protocol, now obsolete due to known vulnerabilities; TLS is its successor and what actually protects today’s web connections, including those of a cloud LIMS.

Does a cloud LIMS automatically comply with GDPR?

Not automatically: it depends on the technical and organizational measures the provider implements and how the laboratory uses them. Hosting data in the EU, encrypting it, controlling access by role, and maintaining backups all support compliance, but final responsibility remains with the laboratory as the data controller.

Does the NIS2 Directive affect water-testing laboratories?

NIS2 places the water sector among those of high criticality, but its direct obligations fall mainly on drinking water and wastewater operators, not on each individual laboratory. Even so, a laboratory that supplies those operators can be reached by cybersecurity requirements passed down contractually under NIS2, even before every member state completes national transposition.

What happens if my laboratory suffers a cyberattack and loses data?

With automated, encrypted backups, data loss is limited to a minimal time window and recovery is a standard process. Without backups—or with outdated backups on a local server—the loss can be irreversible, on top of any notification obligations to data protection authorities if personal data is affected.