Water Systems Are Still Not Secure and Are Being Attacked

The first time I remember reading about an attack targeting water systems was in 2021. It seems not every system has taken action to secure against attacks since then. Hackers targeted municipal water systems in 7 states this week, FBI says

Some day cities, counties, states, and other public agencies will take security seriously. Unfortunately, today is not that day.

Cyberattacks targeting municipal water systems have been reported in at least seven states this week, prompting the FBI and the Environmental Protection Agency to warn utilities nationwide that hackers are trying to disrupt critical water infrastructure.

The attacks come after 30 water systems in Minnesota were targeted.

The new federal advisory said the malicious cyber actors, or MCAs, targeted specific brands of control systems used by municipal water utilities, though the FBI and the EPA urged operators of all systems to take precautions.

This warning should not be necessary, but apparently a lot of government agencies still believe in the myth that "it can't happen to us." They basically believe that they live on magic dirt, or that their zip code protects them from cyberattack. Spoiler Alert: It does not.

Infrastructure should not be on the public internet. If you think your particular bit of infrastructure needs to be on the public internet, then you need every bit of intrusive security you can think of.

The Cybersecurity and Infrastructure Security Agency (CISA) - the agency named by the Department of Redundancy Department - has issued guidance in this area. CISA Joins Australia and Others to Publish Guidance to Isolate Operational Technology and Enabling Systems in Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency, Australian Signals Directorate (ASD), United Kingdom’s National Cyber Security Centre (NCSC-UK), and Canadian Centre for Cyber Security (CCCS) published CI Fortify – Advice for Isolating Vital Systems. This joint guidance, led by ASD, helps critical infrastructure operators protect essential services from escalating cyber threats and ensure continuity of operations during cyber incidents or geopolitical crises.

The document can be found at this link. CI Fortify – Advice for isolating vital systems. The documentation is available in a couple of formats. The PDF is 16 pages long.

The information about the Minnesota attacks can be found at Iran hackers hit 30 Minnesota public water systems in coordinated cyberattack

The 2021 attack info can be found at In Florida city, a hacker tried to poison the drinking water.

I documented this mostly for my own reference, but if I lived in a more urban area, and relied on a municipal or county water agency, I might be tempted to write a FOIA request about cybersecurity efforts. You can't ask for details of the security, but you can ask for budget information.

And I still think the CISA logo looks to be straight out of the 1960s, or maybe the '50s.

UPDATE: This has now reached the regular news. Good Morning America has had a story on the situation. 7 states now targeted by cyberattacks on American water system: Sources