Government-run water systems are still at risk of attack by cybercriminals and nation-states, according to a new advisory from the US’s top cybersecurity agency. The notice from the US Cybersecurity and Infrastructure Security Agency (CISA) came two days after Arkansas City, Kansas, reported a cybersecurity issue that forced it to switch to manual operations.
Last week, US DHS CISA said it continues to “respond to active exploitation of internet-accessible operational technology (OT) and industrial control systems (ICS) devices, including those in the Water and Wastewater Systems (WWS) Sector.” “Exposed and vulnerable OT/ICS systems may allow cyber threat actors to use default credentials, conduct brute force attacks, or use other unsophisticated methods to access these devices and cause harm,” CISA said. The cyber agency urged operators to apply previously released recommendations to defend systems.
The attack on Arkansas City, home to about 11,000 people, started on 22 September. City Manager Randy Frazer declined to answer questions about whether the FBI and CISA were involved in the response to the attack, but said the water supply “remains completely safe and there has been no disruption to service.” "Out of caution, the Water Treatment Facility has switched to manual operations while the situation is being resolved. Residents can rest assured that their drinking water is safe, and the City is operating under full control during this period," he said on 23 September. He said cybersecurity experts and government authorities are now working to resolve the situation. He did not respond to requests for an update on Wednesday.
Due to their importance, the more than 150,000 public water systems in the US have become a focal point of debate about what role federal and state governments have in protecting the public from a cybersecurity perspective.
Water industry groups last year partnered with Republican lawmakers to stop federal efforts to protect water systems despite significant increases in the number of ransomware attacks and nation-state intrusions. Even after a string of attacks on US water systems last Fall by hackers allegedly connected to the government of Iran, groups like the American Water Works Association have insisted that they should be able to write their own cybersecurity rules governing the sector.
Several cybersecurity experts said they have seen an increase in attacks on industrial water systems and echoed CISA in explaining that one of the key issues is the fact that many water systems continue to connect industrial tools to the internet as a way to remotely manage them.
Waterfall Security Solutions CEO Lior Frenkel said that in his extensive work with water system operators, many either don’t know what tools are connected to the internet or believe the risks outweigh the dangers. “Systems that are connected to the internet can be shut down or manipulated or can impair the process that they are controlling,” he said. “All of that should never be accessible from the internet unless there's such a need that you can say that need is stronger than the risk. But the default today is they are connected. We try to put them off the grid. The default should be everything is off the grid, and you connect only what's the bare necessity.”
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
Comments