OT Cybersecurity within the Water & Wastewater Sector

Overview

With many cities jumping on the smart city bandwagon, few are stopping to think about the implications of security breaches, especially within the water and wastewater sector.

Ransomware on computers can impact operations due to loss of systems or data, but incidents involving SCADA systems can have much more severe consequences. The City of Oldsmar incident showed how easy it can be for a malicious actor to make modifications, such as adjusting the sodium hydroxide to a level that would be toxic to people. Past events like this show how cybersecurity incidents at water treatment facilities can have the potential to cause serious harm to the public. They can also result in significant damage to plant, major outages, harm to the environment, serious regulatory actions, and major negative publicity.

Common Causes of Cyberattacks

Cybersecurity incidents aren’t always from specialist hackers trying to disrupt society. Reality is, rural systems are much more likely to experience an incident through other causes. The following is the list of likely causes, in priority order:

1. Mistake made by authorized employee or contractor
2. Current or former disgruntled employee or contractor seeking revenge
3. Ransomware attack from organized crime or random individual
4. Targeted attack from nation state

Basic Cybersecurity Recommendations for Water Sector

Some of the basic actions that can reduce the likelihood of a cybersecurity incident within the water or wastewater sectors includes the following actions

1. Remove Insecure Remote Access: SCADA servers and HMIs should not be using remote access software such as Team Viewer, LogMeIn, Parallels Access, etc. Authorized users should only be able to access your SCADA resources through secure channels involving multiple layers of protection.
2. Vulnerability Scanning & Penetration Tests: CISA’s Vulnerability Scanning is a free service that continuously assesses the health of your internet-accessible assets by checking for known vulnerabilities, weak
   configurations—or configuration errors—and suboptimal security practices. Once those findings have been remediated, we then recommend getting a penetration test performed with a purple team focus.
3. Training & Awareness: Employees and contractors should be aware of the cybersecurity risks that exist, and the actions that they need to take to contribute to the mitigation of these risks. Red Trident offers a Prevention Training that includes general education, skill development, blue team preparedness, incident response preparedness, and other courses to ensure your organization has the right skills.
4. Secure User Accounts: Tools such as Keeper and 1Password can be beneficial to make sure credentials are unique, strong and haven’t been leaked on the dark web.
5. Proper Offboarding Processes: Since disgruntled former employees can pose a large risk, it’s vital to make sure you have a well documented offboarding process. It’s important to lay out who is in charge of each step such as collecting devices, removing access, etc.

Water Sector Threat Categories

EPA has grouped cyber-attacks on water utilities into two threat categories. One is cyber-attack on business enterprise systems, which includes computer-based communications, fnancial, data and record keeping, and other related systems. The second is cyberattack on process control systems, which includes electronic monitoring and control systems used for water collection, treatment, storage, and distribution across the utility. Image below is from epa.gov