Water utilities need to increase cyber security now, according to experts gathered by the Center on Cyber and Technology Innovation and the Cyberspace Solarium Commission. Their recent panel discussion, Strengthening the Cybersecurity of American Water Utilities, included the Chair of the House Armed Services Subcommittee on Cyber, Innovative Technologies and Information Systems, as well as Ameican Water Works Association Federal Relations Managers and the former Deputy Assistant Administrator for the Environmental Protection Agency’s Department of Water.
Representatives highlighted a 2021 incident in Florida where hackers took control of a public water system and attempted to poison people by increasing the levels of a water treatment chemical. That attack was thwarted because a plant operator saw a mouse pointer moving around the screen on its own (by hackers remotely) and accessing systems.
Water Systems Are a Prime Target for Hackers
Water systems are an enticing target for hackers because they are critical infrastructure and because they are increasingly web-connected and unsecured. Remote operating systems accessible online are one source of vulnerability. Another source is web-connected infrastructure, including valves and sensors, along with any communication systems that connect functional equipment to operating systems.
Who Is Behind Cyber Attacks on Water Systems?
In addition to the for-profit hackers who go after many kinds of United States infrastructure, water utilities face unique cyber risks from state-sponsored hackers. Public water supplies are a known target in cyber warfare. Cyber attacks on water utilities may also come at any time from terrorists or rogue states seeking to create chaos and uncertainty. Had the Florida attack been successful, hundreds, if not thousands, of people may have been poisoned, and people throughout the United States would have been fearful of similar attacks.
What Can Water Utilities Do to Improve Cyber Security?
Unfunded EPA regulations do not keep the water supply safe. All water utilities know the steps they are expected to take, but most lack the resources or understanding of what needs to be done. Water system operators are experts in water systems, not cyber security. Complex infrastructure installed over time, some of which may rely on outdated computer hardware or software, presents additional challenges.
Protect Now offers a variety of solutions to improve water utility cyber security, including Virtual CISO support, phishing prevention programs, and cyber security training for employees. Our security solutions and security awareness training work with your existing infrastructure and employees. We will help you center cyber security as a critical piece of your services, and empower your employees to recognize and respond to potential threats.
Written by Robert Siciliano, CEO of Credit Parent, Head of Training & Security Awareness Expert at Protect Now, #1 Best Selling Amazon author, Media Personality & Architect of CSI Protection Certification.