US water authority cyberattack sign of emerging risk

A thwarted cyberattack on a Pennsylvania water authority in November that was attributed to an Iran-aligned cyber group unit should serve as a warning to utilities throughout the US, cyber experts say. More attacks, which could lead to catastrophic incidents, are possible, so water districts should ensure they have at least basic cybersecurity measures in place to protect their systems, they add. The resources of the more than 148,000 water systems in the US vary dramatically, but even simple measures can go a long way to provide protection. Government resources, including the US Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, and the Department of Commerce’s National Institute of Standards & Technology can provide valuable help. In the Pennsylvania attack, an Iran-aligned cyber group, CyberAv3ngers, seized partial control of a booster station operated by the Municipal Water Authority of Aliquippa that used operational technology in the form of programmable logic controllers made by Unitronics, an Israeli company. The hackers issued a warning against using “made in Israel” equipment during the attack, which was foiled and did not affect operations. Other organisations in the US and elsewhere were also reportedly attacked by the same group. “What you have here is a cyberattack against our infrastructure on US soil”, backed by the Iranian Revolutionary Guard, said Joseph R. Weiss, managing partner at Applied Control Solutions. “I can’t say I’m all that surprised” by the attack, said Joey Sylvester, managing director of cyber risk management at Arthur J. Gallagher & Co. “It’s probably a matter of time” before there is somebody with the resources, technological know-how and motivation to do something bigger and broader, he added. “It’s a big deal,” said William Altman, principal cybersecurity consultant with CyberCube Analytics. “A cyberattack that impacts critical infrastructure, and specifically the operational technology structure, is very serious, as it could potentially bridge the divide between the digital and physical world,” Altman said. An attack on water facilities “rises to the highest level of severity and concern”, he continued. The Pennsylvania authority did not reset the default password for logging into its system and had used the default, out-of-the-box password instead, experts say. Something as simple as changing the password might have safeguarded against the incident, said Joe Quinn, cyber claims leader at WTW. Jason Rebholz, chief information security officer at Corvus Insurance, said that while it is already standard practice not to use default passwords, a “different mindset” is needed when the security lapse involves industry controls in an environment, such as water, that affects the “physical world”. Help is available, the cyber experts say. “The threat is constantly evolving, but there are certainly a number of things... that we encourage utilities to implement”, including guidance based on a NIST framework, said Kevin Morley, manager of federal relations for the American Water Works Association, an industry group. It is a matter of “basic cyber hygiene”, Altman said. Steps recommended by federal agencies include implementing multifactor authentication, using strong, unique passwords, and checking programmable logic controllers for default passwords. Tom Finan, senior vice-president and a cyber insurance broker with WTW, said questions to address include whether redundancies are built into a system, if fired employees’ access capabilities are disabled, and whether employees are being effectively trained to not click on phishing links. Well-funded US water districts have expertise, and protections are top of mind, said Travis Wong, vice-president of customer engagement at Resilience Cyber Insurance Solutions. “But that isn’t necessarily the case across all water districts,” he added. Jennifer Lyn Walker, director of infrastructure cyber defense at the Washington-based Water Information Sharing & Analysis Center, encourages larger utilities to connect with neighbouring, smaller ones and “take them under their wing”. This article first appeared on our sister website Business Insurance. For further news from Business Insurance, please click here.

US water authority cyberattack sign of emerging risk

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

Related Articles