Alert

Cyberattacks Against U.S. Water Supplies on the Rise: EPA Urges Utilities to Fortify Defenses

May 31, 2024

The increasing threat of cyberattacks against U.S. water supplies has raised significant concerns among federal officials, who emphatically stress the need for utilities to bolster their cybersecurity measures. A recent announcement from the U.S. Environmental Protection Agency (EPA) highlighted the alarming frequency of cyber intrusions targeting these critical infrastructures, underscoring the need for enhanced protection and vigilance.

The EPA’s inspection over the past year revealed a troubling statistic: approximately 70% of water utilities evaluated did not meet the established standards designed to prevent cyber breaches. These findings spotlight the persistent vulnerabilities within the nation’s water supply systems, emphasizing the urgency for water utilities to revamp their security protocols to safeguard against potential threats. The agency reported that cyberattacks could result in interruptions to water treatment and storage, damage to pumps and valves, and the alteration of chemical levels to hazardous amounts.

“Many systems are failing to meet their obligations, which include conducting a comprehensive risk assessment of their vulnerabilities—cybersecurity included—and ensuring that this plan guides their operations,” stated EPA Deputy Administrator Janet McCabe.

McCabe identified China, Russia, and Iran as nations “actively seeking the capability to disable U.S. critical infrastructure, including water and wastewater systems.”

Late last year, an Iranian-linked group known as “Cyber Av3ngers” targeted several organizations, including a small Pennsylvania town’s water provider. This attack forced the provider to switch from remote pump operations to manual controls. The group targeted an Israeli-made device used by the utility in response to Israel’s conflict with Hamas.

Rise in Cyberattacks

The increase in cyberattacks against U.S. water utilities is an alarming trend that poses risks to public health and safety. Cybercriminals and malicious actors often target water supply systems due to their critical role in public infrastructure. These attacks can result in severe consequences, including contamination of water supplies, disruption of service, and damage to infrastructure.

Experts attribute the rise in cyberattacks to several factors. As cybercriminals become more sophisticated, their methods are evolving to exploit weaknesses in critical infrastructure systems. Additionally, the increased digitization and interconnectedness of water utilities’ operations present more entry points for potential attackers.

The EPA’s Call to Action

The EPA’s findings have prompted a call to action for water utilities across the nation to enhance their cybersecurity measures. The agency emphasized that utilities must rigorously adhere to federal standards designed to protect against cyber threats. These standards include implementing robust security controls, conducting regular risk assessments, and ensuring employees are trained in cybersecurity best practices.

Ensuring compliance with these standards is vital for mitigating the risk of cyberattacks. The EPA pointed out that while many utilities have made strides in improving their cybersecurity posture, a significant number still fall short of the required protections.

Steps Utilities Can Take

Water utilities are urged to adopt a multi-faceted approach to fortify their defenses against cyber threats. Key measures include:

1. Regular Security Audits: Conducting frequent security assessments to identify and remediate vulnerabilities in their systems.

2. Employee Training: Ensuring that staff are well-versed in cybersecurity practices and aware of potential threats.

3. Access Controls: Implementing strict access controls to prevent unauthorized access to critical systems and data.

4. Incident Response Plans: Developing and regularly updating incident response plans to quickly and effectively address any breaches that occur.

5. Collaboration: Engaging in information-sharing initiatives with other utilities and government agencies to stay informed about emerging threats and effective countermeasures.

The Road Ahead

The EPA’s announcement serves as a stark reminder of the growing cyber threats facing the nation’s critical infrastructure. As water utilities work to address these challenges, it is imperative for them to prioritize cybersecurity and continuously evolve their protective measures. The safety and reliability of the water supply depend on collaborative efforts between federal agencies, utilities, and cybersecurity experts to ensure robust defenses against this escalating threat.

I previously wrote that it is of the utmost importance that all public water systems review and implement the new guidelines as soon as possible. The EPA is now aggressively enforcing and will increase the number of community water systems inspections that focus on cybersecurity. Where vulnerabilities are identified and may present an imminent and substantial endangerment to public health, the EPA will initiate enforcement actions under SDWA Section 1431 to mitigate those risks.

The Takeaway

The rise in cyberattacks against U.S. water supplies is a pressing issue that calls for immediate action. By adhering to federal standards and implementing comprehensive security measures, water utilities can better safeguard their systems and protect public health and safety from the growing threat of cyber intrusions.