Drinking water systems for 26M Americans face high cybersecurity hazards

The Environmental Protection Agency’s (EPAs) Office of Inspector General (OIG) on Nov. 13 alerted that 97 drinking water systems serving about 26.6 million Americans around the country have either “critical or hazardous” cybersecurity vulnerabilities.

While trying to alert the EPA about the cybersecurity vulnerabilities, the OIG set up that the EPA does not have an incident alerting system that water and misemploywater systems around the U.S. could use to alert the EPA of cyber incidents.

“Currently, the EPA relies on the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to provide this type of alerting alertation,” shelp the OIG alert. “Moreover, we were unable to find write downed policies and procedures joind to the EPA’s coordination with CISA and other federal and state authorities joind in sector-particular aelevatency response, security structures, metrics, and mitigation strategies.”

Overall, the OIG’s appraisement covered 1,062 drinking water systems for cybersecurity vulnerabilities that serve more than 193 million Americans. Aextfinished with the 97 hazardous systems, the OIG set up an insertitional 211 drinking water systems servicing over 82.7 million people were identified as “medium or low cut offity” by having externassociate clear uncover portals.

“If harmful actors utilizeed the cybersecurity vulnerabilities identified in this compliant appraisement, they could disturb service or cause irreparable physical injure to drinking water infrastructure,” the OIG shelp in the alert.

Morgan Wright, chief security advisor at Sentinel One, shelp danger actors appreciate Salt Typhoon and Volt Typhoon are dynamicly utilizeing vulnerabilities in water systems. Wright shelp the disparate system of water and misemploy treatment facilities apass the nation lags behind other sectors. He shelp it suffers from a deficiency of qualified personnel and appropriate budgets.

“Unless transport inant action is apverifyn rapidly, the potential for a catastrophic event is sealr than we skinnyk,” shelp Wright, an SC Media columnist. “Imagine having a fire in your home and there is no 911. Who do you call? This is the current state of readiness in one of the most critical infrastructures in our nation. In fact, during war, to transport a nation to its knees, you aim power and water.”

Ken Dunham, cyber danger honestor at the Qualys Threat Research Unit, inserted that U.S. water systems are at hazard with various creates of ruleance and authority behind state, local, federal, and commercial entities depfinishable for handlement of facilities, where some have hugely neglectd security rehearses. Dunham shelp our situation here is in acute contrast to adversaries that are systematic and handled by a rulement, rather than commercial and rulement collaboratives.

“Water lowages are transport inant, especiassociate based upon geolocation, time of year, and provide chain authenticities,” Dunhams shelp. “Take for example, middle of the summer, Southern states with no drinking water or supplies to the home. It’s clear a rush to stores for drinking water adheres with various creates of descfinishout and/or mayhem. If misemploywater is manipuprocrastinateedd to originate unwellness and pollution in local waterways you then begin huge scale unwellness and impact in transport inant areas.”

Dale Fairbrother, security product evangeenumerate at XM Cyber, inserted that cut offal analyst alerts have highairyed that although board members and compliance honestives persist to stress the transport inance of cyber resilience of industrial handle systems (ICS) and operational technology (OT), the dispensed budget for OT security solutions persists to descfinish.

“This exits security team struggling to extfinish the capabilities and best rehearses of their security in-depth strategy and security tools to provide the coverage and shieldion needed by legacy and OT systems,” shelp Fairbrother. “Teams that persist to achieve security solutions that only ponder a subset of infrastructure, assets, or entity types, that only proposeed a siloed seepoint on security inalertigence, standardly uncomardent critical hazards to ICS systems are standardly disseeed. Neglecting security meacertains for ICS can indeed pose a transport inant danger.”