EPA says cyberattacks against U.S. water system on the rise
Cyberattacks on U.S. water system on the rise: EPA
Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water.
NEW YORK - Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water.
The nation's more than 148,000 public water systems are locally owned and operated on a wide range of budgets.
"So that means a lot of these systems are stretched thin fiscally. They just have enough budget to keep the water system running," said Rick Geddes, a professor of infrastructure policy at Cornell University.
Tech in recent years has become increasingly vital in maintaining water systems and the EPA reported that roughly 70% of utilities inspected by federal officials over the last year violated standards meant to prevent breaches or other intrusions.
"If a cyber-attack could engineer a shutdown of the power to a water plant, it would stop the water from flowing," said Geddes.
The agency reports that the potential consequences of cyberattacks on drinking and wastewater systems include interruptions to treatment and storage; damage to pumps and valves; and hazardous changes to chemical levels in our water.
"Cybersecurity is not something they’ve focused on as much as say large power grids, so this is sort of new to them and it again a wake-up call," Geddess told FOX 5.
Recent attacks are not just by private entities. Some recent hacks of water utilities are linked to geopolitical rivals, and could lead to the disruption of the supply of safe water to homes and businesses.
McCabe named China, Russia and Iran as the countries that are "actively seeking the capability to disable U.S. critical infrastructure, including water and wastewater."
Late last year, an Iranian-linked group called "Cyber Av3ngers" targeted multiple organizations including a small Pennsylvania town's water provider, forcing it to switch from a remote pump to manual operations. They were going after an Israeli-made device used by the utility in the wake of Israel's war against Hamas.
Earlier this year, a Russian-linked "hacktivist" tried to disrupt operations at several Texas utilities.
A cyber group linked to China and known as Volt Typhoon has compromised information technology of multiple critical infrastructure systems, including drinking water, in the United States and its territories, U.S. officials said. Cybersecurity experts believe the China-aligned group is positioning itself for potential cyberattacks in the event of armed conflict or rising geopolitical tensions.
Now, the EPA is instructing water providers to consistently change passwords, develop stronger risk assessment plans, and set up backup systems.
The EPA is also offering federal assistance to take those steps but, cybersecurity expert Robert Siciliano recommends the systems invest in third parties.
"Manage security service providers are third-party security services that will provide vulnerability scanning, antivirus, and system upgrades to prevent intrusions," said Siciliano.
Though smaller staffs and tighter budgets in smaller water systems across the country complicate building a defense against cyberattacks, the E-P-A advises all water systems to take the necessary steps to prevent attacks.