In response to a surge in cyber-attacks on water systems, the Environmental Protection Agency (EPA) is urging municipalities across the United States to bolster their cybersecurity defenses. Recent attacks on small communities in Texas and Pennsylvania, allegedly orchestrated by foreign hackers, have highlighted vulnerabilities in the nation’s water infrastructure.
An EPA inspection of drinking water systems revealed significant cybersecurity weaknesses, prompting the agency to issue a warning to utilities, including those in Mid-Michigan. Vernon Myers, Chief Information Officer for Lansing Board of Water and Light (BWL), emphasized the importance of these recommendations. BWL experienced a cyber-attack in 2016, although it did not affect its electricity or water utilities.
“We prioritize the safety of our utility, customers, and employees,” Myers stated. He acknowledged the necessity of learning from incidents that affect other utilities to avoid similar pitfalls.
The EPA’s recommendations for enhancing water system security include minimizing exposure to the internet, performing regular cybersecurity assessments, changing default passwords, and maintaining comprehensive inventories of operational and information technology assets. Additionally, the agency advises developing and testing incident response plans, backing up systems, mitigating vulnerabilities, and conducting cybersecurity training for staff.
Tom Holt, a cybersecurity expert and professor at Michigan State University, highlighted the inevitability of cyber-attacks in the current global climate. “It’s not a matter of if you get hacked, but when,” Holt noted. He stressed the importance of evaluating access points and employee vulnerability to phishing attacks.
EPA inspections revealed several security lapses, such as outdated default passwords and easily compromised single logins. Although recent attacks were resolved swiftly, one incident in Texas led to a water system overflow. Holt warned of potential worst-case scenarios, including total water contamination, and underscored the persistent threat due to ongoing global conflicts.
The EPA is offering technical assistance, training, and educational resources to help communities enhance their security measures. The agency’s inspections also uncovered that over 70% of water systems do not meet the Safe Drinking Water Act’s clean water standards, compounding the urgency of addressing these vulnerabilities.
