RE: Water Security16 Dec 2021 13:16
At the same time, a ransomware attack on a wastewater treatment plant in Mount Desert, Me., placed all of the facility’s computers out of operation for three days, though the operation of the plant itself was reportedly not affected.
The nearby town of Limestone, Me., was also the victim of a ransomware attack in early July, most likely the result of running an outdated computer operating program. The Limestone facility recovered with no serious consequences.
Risk for Small Operators
“From our perspective, the water/wastewater sector utilities are likely to be targeted regardless of size,” said Fabion Husson, insights branch chief at CISA.
Large utilities, such as those serving cities with more than 50,000 customers, may be more prone to sophisticated attacks, continued Husson. Small to medium-sized utilities, meanwhile, have a higher likelihood of both sophisticated and unsophisticated attacks because they provide a less risky testing environment for attackers.
But with cybersecurity efforts being funded primarily by the utility service providers, the smallest water utilities may be the least prepared for attacks. Without dedicating sufficient resources toward security posture, even very basic attacks can have major consequences for these organizations.
In August, the cybersecurity firm ThreatLocker found that 38 percent of water companies spent less than one percent of their budget on IT security and that 44.8 percent spent less than one percent on OT security. Many facilities also continue to use software and operating systems beyond their end-of-life status. These outdated systems mean additional vulnerabilities for attackers.
“The small to medium utilities in the water/wastewater sector are fighting more of an uphill battle than a medium or large one,” said Chris Grove, technology evangelist for cybersecurity firm Nozomi Networks, “typically because they have a lot fewer resources to work with than a big city water facility that has millions of dollars.”
“When you’re talking about some of these really small operators, sometimes the IT department is one-tenth of one person’s job while 90 percent of that person’s job is real physical engineering work,” continued Grove, “Tasking someone responsible for keeping our water pure [along] with [the added job of] cybersecurity is almost like an unfair ask.”
He recommends that smaller utilities focus on tasks that simplify operations and allow them to do more with less. Software-as-a-Service (SaaS), for example, provides operators with pre-established security technology so that resources won’t need to be dedicated toward establishing separate protocols.
“They should also focus on having a good backup strategy,” continued Grove. “If you can’t build a good defense, and you know you’re not going to be able to defeat the attackers when they get there, then accept that.”
Sign In
Follow the stocks
