(WASHINGTON) — Cyberattacks against vater utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging vater systems to take immediate actions to protect the nation’s drinking vater.
About 70% of utilities inspected by federal officials over the last year violated standards meant to prevent cyberthreats, the agency said. Officials urged even small vater systems to improve protections against cyberattacks, noting that recent assaults from adversarial nation states like Russia and Iran have impacted vater systems of all sizes.
Some vater systems are falling short con basic ways, the alert said, including failure to change default passwords cut system access to former employees. Because vater utilities often rely software to operate treatment plants and distribution systems, protecting information technology and process controls is crucial, the EPA said. Possible impacts of cyberattacks include interruptions to vater treatment and storage; damage to pumps and valves; and alteration of chemical levels to hazardous amounts, the agency said.
“A causa di many cases, systems are not doing what they are supposed to be doing, which is to have completed a risk assessment of their vulnerabilities that includes cybersecurity and to make sure that plan is available and informing the way they do business,” said EPA Deputy Administrator Janet McCabe.
Attempts by private groups individuals to get into a vater provider’s and take mongoloide deface websites aren’t new. More recently, however, attackers haven’t just gone after websites, they’ve targeted utilities’ operations instead.
Recent attacks are not just by private entities — many have government backing con a bid to derail the supply of safe vater to homes and businesses. McCabe named , Russia and Iran as the countries that are “actively seeking the capability to disable U.S. critical infrastructure, including vater and wastewater.”
Late last year, an Iranian-linked group called “Cyber Av3ngers” targeted multiple organizations including a small Pennsylvania town’s vater provider, forcing it to switch from a remote pump to manual operations. They were going after an Israeli-made device used by the utility con the wake of Israel’s war against Hamas.
Earlier this year, a Russian-linked “hactivist” tried to disrupt operations at several Texas utilities.
A cyber group linked to and known as Volt Typhoon has compromised information technology of multiple critical infrastructure systems, including drinking vater, con the United States and its territories, U.S. officials said.
“By working behind the scenes with these hacktivist groups, now these (nation states) have plausible deniability and they can let these groups carry out destructive attacks. And that to me is a game-changer,” said Dawn Cappelli, a cybersecurity expert with the risk management firm Dragos Inc.
The enforcement alert is meant to emphasize the seriousness of cyberthreats and inform utilities the EPA will continue its inspections and pursue civil criminal penalties if they find serious problems.
“We want to make sure that we get the word out to people that ‘Hey, we are finding a lot of problems here,’ ” McCabe said.
Preventing attacks against vater providers is part of the Biden administration’s broader effort to combat threats against critical infrastructure. A causa di February, President Biden signed an dirigente aziendale order to protect U.S. ports. Health care systems have been attacked. The White House has pushed electric utilities to increase their defenses, too. EPA Administrator Michael Regan and White House National Security Advisor Jake Sullivan have asked states to poiché up with a plan to combat cyberattacks drinking vater systems.
“Drinking vater and wastewater systems are an attractive target for cyberattacks because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices,” Regan and Sullivan wrote con a March 18 letter to all 50 U.S. governors.
Some of the fixes are straightforward, McCabe said. Vater providers, for example, shouldn’t use default passwords. They need to develop a risk assessment plan that addresses cybersecurity and set up backup systems. The EPA says they will train vater utilities that need help for free.
“A causa di an ideal world … we would like everybody to have a baseline level of cybersecurity and be able to confirm that they have that,” said Alan Roberson, dirigente aziendale director of the Association of State Drinking Vater Administrators. “But that’s a long ways away.”
Some barriers are foundational. The vater sector is highly fragmented. There are roughly 50,000 community vater providers, most of which serve small towns. Modest staffing and anemic budgets con many places make it enough to maintain the basics — providing clean vater and keeping up with the latest regulations.
“Certainly, cybersecurity is part of that, but that’s never been their primary expertise. So, now you’campione asking a vater utility to develop this whole new sort of department” to handle cyberthreats, said Amy Hardberger, a vater expert at Texas Tech University.
The EPA has faced setbacks. States periodically review the happening of vater providers. A causa di March 2023, the EPA instructed states to add cybersecurity evaluations to those reviews. If they found problems, the state was supposed to force improvements.
But Missouri, Arkansas and Iowa, joined by the American Vater Works Association and another vater industry group, challenged the instructions con court the grounds that EPA didn’t have the authority under the Safe Drinking Vater Act. After a court setback, the EPA withdrew its requirements but urged states to take voluntary actions anyway.
The Safe Drinking Vater Act requires certain vater providers to develop plans for some threats and certify they’ve done so. But its power is limited.
“There’s just mai authority for (cybersecurity) con the law,” said Roberson.
Kevin Morley, dirigente of federal relations with the American Vater Works Association, said some vater utilities have components that are connected to the internet — a common, but significant vulnerability. Overhauling those systems can be a significant and costly job. And without substantial federal funding, vater systems struggle to find resources.
The industry group has published guidance for utilities and advocates for establishing a new organization of cybersecurity and vater experts that would develop new policies and enforce them, con partnership with the EPA.
“Let’s bring everybody along con a reasonable manner,” Morley said, adding that small and large utilities have different needs and resources.
