How the Water Industry is Responding to Cyberattacks.
As if Americans don’t have enough to worry about this year, the security of our drinking water and wastewater resources is now in question. At least five states, California, Florida, Texas, Arizona and New York have all reported cyber-attacks on their water treatment systems. These are coming from Iran, Russia, China and potentially North Korea.
Officials have pin-pointed several cyberattack groups within those nations with names like CyberAv3ngers (Iran), Volt Typhoon (China), Sandworm and Cyber Army of Russia Reborn (Russia). These attacks are increasing in both frequency and severity. Going on for as long as five years now, in addition to the water infrastructure, attacks have also targeted maritime ports, electrical grids and even pipelines.
There are various explanations for why these attacks are coming from the various actors. In recent years, Russia and Iran have established a closer relationship, just as US-Russian relations have worsened over the conflict in Ukraine and the attacks may be related to US support of Ukraine’s defenses. Likewise, a recent report by the Brookings Institute points to how both China and the US have a pessimistic outlook regarding their own internal situations; historically, at these times the relationship between our two nations has suffered. Regarding China, various Federal departments and agencies believe that Volt Typhoon is preparing to disrupt critical infrastructure operations in the event of an Asia Pacific military conflict with the US. Chinese efforts have also recently targeted American communication network and transportation systems. A common point of vulnerability has been the failure to change location-specific cyber passwords from the manufacturer’s default. In a recent audit, more than 70% of inspected facilities were found to be out of compliance with various standards.
Of the 16 different types of infrastructure we have in America, our water system may be the most vulnerable. Think about it. There are 150,000 different, mostly automated (internet of things model) water districts. In addition, there are another 16,000 government operated water utilities. More than 97 percent of these water districts are small, serving around 10,000 people each. The vast majority of these operations do not have in-house IT or cybersecurity departments. Running on razor-thin budgets, with water prices set by public votes, improvements to cybersecurity come via tradeoff; taking from the left pocket to put it in the right one).
Water is closely connected to other systems. Many communities get much of their power from water. Water is used in manufacturing. It’s essential to maintaining public health. An enemy attack on our water systems can stop us in our tracks. Many experts believe it’s only a matter of time before an intruder cripples the delivery of safe, clean water in at least one community in the U.S. The changes are better that it would not be in a single location.
Significant effort is being applied to this critical issue on both legislative and industrial fronts.
Legislative Initiatives
The House of Representatives has recently introduced a bill called the Water Risk and Resilience Organization Establishment Act. It would make way for a non-federal agency to update and manage the cybersecurity requirements for the water industry. Once established, the WRRO will bolster water security by:
Developing specific standards: Currently, there are no specific federal cybersecurity regulations for water systems. The WRRO would develop and enforce these standards, creating a baseline of protection for water treatment facilities.
Leveraging industry expertise: The WRRO would be comprised of experts in both cybersecurity and water systems. This combination of knowledge could lead to more practical and effective cybersecurity measures for the water industry.
Improving collaboration with EPA: The WRRO would work alongside the Environmental Protection Agency (EPA) to ensure the proposed standards are both effective and achievable for water systems.
Establishing a framework for risk assessments: The bill proposes periodic assessments of water systems by the WRRO. This would help identify vulnerabilities and ensure water facilities are keeping pace with evolving cyber threats.
It’s thought that the WRRO would ultimately involve members from various groups including
- Government agencies (EPA, Department of Homeland Security (DHS), Department of the Interior (DOI), and the Army Corps of Engineers)
- Water Industry: Representatives from water utilities, water treatment facilities, and irrigation districts could be involved.
- Research and Academia: Collaboration with universities and research institutions specializing in water management, cybersecurity, and infrastructure resilience is likely (e.g., UCLA, UNC, Chapel Hill, Stanford, MIT etc.)
- Non-profit Organizations: Environmental groups and organizations focused on water security and disaster preparedness could be included. (e.g., water.org, charity:water, the Water Project, Natural Resources Defense Council)
As a model, the WRRO is patterned after the way the electrical industry already governs itself. In that example, the Federal Energy Regulatory Commission (FERC) issues broad requirements and the industry-run North American Electric Reliability Corporation (NERC) crafts the particulars. For the water industry, it would be the EPA who would put an industry-run nonprofit group in charge of developing specific requirements for the agency’s general cybersecurity standards.
The EPA is responsible for auditing the safety of our country’s drinking water. Among other efforts, is the EPA creating a Water Sector Cybersecurity Task Force to identify near-term actions and strategies to reduce the nationwide risk. Given the current political climate however, there is considerable discussion about how WRRO can be enacted in a way that doesn’t extend further power to the EPA.
Self-governance would be a better approach than traditional EPA regulations because the rules would be shaped by the practical experience and input of utility operators themselves. Instead of trying to force fit rules around an industry, you would have standards that apply differently to facilities of different sizes.
Industry Initiatives
Along with governments efforts, water companies themselves are leading in other ways to shore up their defenses against further cyberattacks.
Shoring Up Defenses: Water companies are conducting regular security audits to identify weaknesses in their systems.
They are also implementing stricter access controls to make it harder for hackers to breach their defenses. Last, they are also patching vulnerabilities in their software and firmware to close potential backdoors. These efforts are taking on multiple forms:
- Multi-Factor Authentication (MFA): Water companies are adding an extra layer of security by implementing MFA for all remote access and control systems. This requires not just a username and password, but also a code from a phone app or security key to gain access.
- Segmentation: Large water treatment facilities often have complex computer networks. Segmenting the network creates firewalls between different sections. An attack on the business side wouldn’t automatically grant access to the industrial control systems that manage water treatment.
- Intrusion Detection/Prevention Systems (IDS/IPS): These systems constantly monitor network traffic for suspicious activity. An IDS can alert operators to potential threats, while an IPS can actively block them.
- Physical Security: While cyberattacks are a major concern, physical security is still important. Water companies are limiting access to critical infrastructure and installing security cameras to deter break-ins.
- Cybersecurity Software Updates: Keeping all software up to date is crucial. Water companies are implementing automated patching systems to ensure vulnerabilities are closed quickly.
Employee Training: Recognizing that employees can point of vulnerability, water companies are investing in cybersecurity awareness training to educate staff about potential threats and how to avoid falling victim to phishing attacks or other scams. Training is being done in a number of ways:
- Interactive Training Modules: Water companies can use online modules that present realistic scenarios employees might encounter, like phishing emails or suspicious phone calls. These modules can test employees’ ability to identify threats and take appropriate action.
- Gamification: Gamified training can make learning about cybersecurity more engaging. Games can present challenges that reinforce best practices in a fun and competitive way.
- Targeted Training: Not all employees need the same level of cybersecurity awareness. Companies can provide more in-depth training for IT staff and employees with access to control systems, while general awareness training can be offered to everyone.
- Regular Refresher Courses: The cyber threat landscape is constantly evolving. Regular refresher courses help ensure employees stay up-to-date on the latest threats and best practices.
- Simulated Phishing Attacks: Some companies conduct simulated phishing attacks to test how employees respond. These simulations can help identify weaknesses in employee awareness and provide opportunities for improvement.
Planning for the Worst: Water treatment facilities are developing and practicing incident response plans so they can react quickly and effectively if a cyberattack does occur. This includes having backup systems in place to maintain essential operations. Hoping for the best by planning for the worst is accomplished in many ways:
- Scenario Planning: Water treatment facilities are developing detailed incident response plans that outline specific actions to take in the event of a cyberattack. These plans consider different attack scenarios and identify the roles and responsibilities of different teams. For instance, the plan might detail how to isolate infected systems, contain the damage, and restore critical functions.
- Backup Systems and Redundancy: To minimize disruption, water treatment plants are implementing backup systems for critical functions like chemical feed, filtration, and disinfection. These backup systems can be manually operated or have built-in failover mechanisms to take over automatically if the primary systems are compromised.
- Offline Communication Channels: Cyberattacks can disrupt normal communication channels. Water companies are establishing backup communication plans that don’t rely on the internet or phone networks. This could involve dedicated radio systems, satellite phones, or even courier services to deliver critical information.
- Supply Chain Risk Management: A cyberattack that disrupts a water treatment plant’s supplier could have a ripple effect. Water companies are assessing the cybersecurity posture of their vendors and developing contingency plans in case a critical supplier is compromised.
- Tabletop Exercises: Water treatment facilities can conduct tabletop exercises to simulate a cyberattack and test their incident response plans. These exercises help identify weaknesses in the plan and allow teams to practice their communication and coordination.
Collaboration is Key
Recognizing they are not alone, water companies are increasingly working together to share information about threats and best practices. This collaboration helps the industry as a whole stay ahead of emerging cyberattacks.
- Information Sharing: Water industry associations facilitate information sharing between member companies. This allows them to quickly warn each other about new threats and share best practices for defense and incident response. For instance, an association might issue an alert about a new phishing campaign targeting the water industry, allowing member companies to warn their employees and update their filters to block malicious emails.
- Joint Cybersecurity Exercises: Water companies can participate in joint cybersecurity exercises with other utilities or government agencies. These exercises simulate a large-scale cyberattack and allow participants to test their communication, coordination, and incident response plans in a collaborative setting.
- Standardization and Best Practices: Industry associations can work together to develop cybersecurity standards and best practices for the water industry. These standards can help ensure that all water companies have a baseline level of protection in place.
- Sharing Threat Intelligence: Water companies can share threat intelligence with each other. This can involve sharing information about indicators of compromise (IOCs) that can be used to identify malicious cyber activity. By sharing this information, companies can improve their ability to detect and prevent cyberattacks.
- Government Collaboration: The water industry can collaborate with government agencies to improve cybersecurity preparedness. This collaboration can involve information sharing, joint exercises, and the development of regulations to improve cybersecurity in the water sector.
These are challenging times, and despite it, Caliagua remains bullish about our own future. We feel the same way about the future of our industry and our country. As a company, our story is about continuous improvement leading to success. We’re proud of our ability to adapt to a changing environment; a history of continual improvement, assembling and maintaining the best team, partnering with the best GCs, Subs and vendors in the industry, and delivering to the highest levels possible. These are all the ways we have gone through our own challenging moments. We have no doubt that our industry and our nation will likewise succeed!
Have you got a project you’d like to discuss? Feel free to contact Gus Bruner (gusbruner@caliagua.net) or Cory Wolfrom (cwolfrom@caliagua.net), we look forward to working with you!