Decreasing Cybersecurity Risks for Water Utilities
News stories about cyber attacks are frequently growing. Some of the most attention-grabbing reports involve breaches in commercial businesses that expose credit card information. However, utilities like water systems aren’t immune.
A ransomware attack disrupted the Colonial gas pipeline in May of 2021, leading to gas shortages on the East Coast. In February of the same year, an attack on the water treatment system in Oldsmar, Florida, resulted in a temporary increase of sodium hydroxide in the water supply.
The Threat Cybersecurity Attacks Pose to the Water Industry
Cyber attacks on water systems are a pressing concern because water is a human necessity. Service interruptions in a large area could quickly turn from a nuisance into a crisis, and meddling with water treatment plants could result in contaminated water from potable taps.
Water utilities often use pumps and valves to regulate water flow and pressure in the system. Cyber attacks on this infrastructure could cause dangerous hydraulic shocks. The resulting broken water mains and other cracked pipes would disrupt whole sections of a community.
Why Are Water Systems at Risk?
Internet technology affects every industry, and cybercriminals are growing more sophisticated. Water utilities provide an attractive target because of their essential nature. At the same time, these systems are some of the least prepared to handle cybercrime.
Decentralized Regulation
Local governments or private companies control most water management systems. This arrangement makes it difficult for government agencies to enforce the best practices for preventing cybersecurity attacks. Large, well-funded systems may have robust security measures, but smaller systems have a greater chance of vulnerability.
Legacy Software and Hardware
Most water distribution systems developed in a pre-internet world and spent most of their existence off the grid. As more utilities connect to the web, they’re using older software and hardware no longer supported by the manufacturer. These programs and devices often have exploitable vulnerabilities.
Limited Financial Resources
Smaller water systems must balance providing affordable water with maintaining operations. When money is short, water cybersecurity isn’t a priority.
SCADA and Cybersecurity
SCADA technology has transformed the water industry by providing access to real-time technical and performance data. However, losing control of remote equipment is a danger. SCADA cybersecurity must be part of any discussion of adding SCADA technology.
Ransomware, Phishing, and Spear Phishing
The most frequent cyber attacks on utilities have existed for many years. The goal of cybercriminals is for someone within the target organization to download malicious software or share their credentials.
Ransomware
Ransomware is a frequent attack that goes unreported. Once the criminals gain access to the system, they insert software that encrypts critical data. The target must pay a fee for the criminals to decode the information.
Phishing
Phishing is the first step of many cyber attacks. Criminals send emails throughout the organization with links to corrupt files. It only takes one user to click on a link to give system access to the criminals.
Spear phishing
Spear phishing is a targeted phishing attack. The cyber attackers research someone with authority in the organization to make their emails less suspicious. Upper-level managers may not have the same requirements for cybersecurity training as other people in the organization.
Preventing Cyber attacks on Water Systems
Most successful cyber attacks aren’t the result of hackers breaking through a digital security system. Instead, they use less complicated techniques to trick authorized users into providing access. Regular training and other measures can prevent most attacks.
Water Cybersecurity Training
Every employee should know how to recognize a suspicious email. They should also receive training in creating strong passwords and portable device safety.
Current Cybersecurity Software
The water system must keep its firewall and antimalware software up to date. The organization should also make regular checks for patches to other programs.
Other Access Protocols
Two-step authentication should be the standard for system access. Larger systems may also want to implement role-based access to minimize the effects of a successful attack.
Cloud-Based SCADA Security
One of the advantages of working with a cloud-based system is that the cloud host becomes responsible for many data security issues. While the organization is responsible for maintaining SCADA security through robust access protocols, the cloud host must protect data stored in its servers.
Secure SCADA Systems for the Water Industry
When High Tide Technologies designs your system, high-level SCADA cybersecurity is part of the plan. We understand how the digital age has changed water collection, distribution, and treatment systems. Our cloud-based SCADA solutions will make your system more efficient, responsive, and safe. Contact us today to learn more about implementing SCADA in your organization.