What's Happening?
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to water and wastewater system operators to secure their operational technology (OT) against cyber threats. This alert follows a coordinated cyberattack that disrupted
automated controls at multiple water utilities in Minnesota. CISA has observed a rise in attacks targeting programmable logic controllers (PLCs) in the water sector, urging operators to remove exposed PLCs from the internet. The attacks have led to 'boil water notices' and manual operations, mirroring incidents reported by Minnesota utilities. The agency highlighted that these threats affect water entities of all sizes, emphasizing the need for robust cybersecurity measures.
Why It's Important?
The recent cyberattacks underscore the vulnerability of critical infrastructure in the US, particularly in the water sector. These incidents highlight the growing threat from nation-state actors, such as those linked to Iran, targeting essential services. The attacks have prompted federal and state agencies to enhance security measures to protect public health and safety. The water sector's reliance on outdated technology and insufficient cybersecurity controls makes it a prime target for cyber threats. The situation calls for immediate action to secure critical infrastructure and prevent potential disruptions to water supply and safety.
What's Next?
CISA has recommended several immediate steps for water utilities, including disconnecting PLCs from the internet, using VPNs for remote access, and implementing password protection. The agency also advises maintaining clean backups of PLC images to restore access if compromised. Utilities are encouraged to review tactics and indicators of compromise to detect any ongoing or past malicious activity. As investigations continue, state and federal agencies are working to identify the perpetrators and prevent future attacks. The water sector must prioritize cybersecurity to safeguard against similar threats.
