{"id":3328,"date":"2022-04-04T14:53:18","date_gmt":"2022-04-04T14:53:18","guid":{"rendered":"https:\/\/itegriti.com\/kw022024\/?p=3328"},"modified":"2022-09-12T14:12:45","modified_gmt":"2022-09-12T14:12:45","slug":"essential-frameworks-for-the-water-industry-water-isac","status":"publish","type":"post","link":"https:\/\/itegriti.com\/kw022024\/2022\/managed-services\/essential-frameworks-for-the-water-industry-water-isac\/","title":{"rendered":"Essential Frameworks for the Water Industry: Water ISAC"},"content":{"rendered":"

Protecting our nation\u2019s water supply is vital. It falls under the category of Critical National Infrastructure (CNI), and represents a resource so necessary to the United States \u201cthat [its] incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.\u201d However, at this point, there are not strong Federal guidelines surrounding cybersecurity for the water industry.<\/p>\n

In comes WaterISAC, a nonprofit dedicated to keeping the nation\u2019s water and wastewater plants cyber secure. WaterISAC<\/a>, is a \u201ccomprehensive and targeted single point source for data, facts, case studies, and analysis on water security and threats from intentional contamination, terrorism, and cybercrime.\u201d In the words of the ISAO Standards Organization,<\/a> \u201cWaterISAC helps members strengthen their physical and cyber security, recover from natural and man-made disasters and improve overall preparedness and resilience.\u201d In 2019 they released their 15 Cybersecurity Fundamentals for Water and Wastewater Facilities<\/a>, a set of benchmarks designed to \u201cbe helpful to utilities preparing risk and resilience assessments required by America\u2019s Water Infrastructure Act, or AWIA.\u201d More on the act, later.<\/p>\n

To understand the context of these frameworks, it\u2019s necessary to understand the state of the industry, the threats being faced and how policy can help.<\/p>\n

Threats to US Water Supply<\/strong><\/h2>\n

In October,<\/a> the FBI, Environmental Protection Agency, National Security Agency and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory warning that<\/a> U.S. water and wastewater systems are being targeted by \u201cknown and unknown\u201d malicious actors. And, we see it happening.<\/p>\n

\u201cIt’s the kind of breach that has been warned about for years but is rarely seen,\u201d reads the headline.<\/a> In February of last year, bad actors compromised a TeamViewer account, infiltrating the water supply in Oldsmar, Florida and nearly succeeding at raising the chemical levels to toxic amounts.<\/p>\n

In May of last year, two Pennsylvania water plants were victims of attempted hacking<\/a>. The attacks were thwarted, but the superintendent of the Municipal Authority over the water supply revealed ” it is alarming and it is a very vulnerable business.\u201d<\/p>\n

And the Metropolitan Water District experienced its own water scare, showing us that those looking to undermine the sector are not only going for small municipal facilities, but big game. The Pulse Secure hack<\/a> compromised a device meant to boost internet security and was thought to be a nation-state attack. According to experts, \u201c[S]ophisticated hackers exploited never-before-seen vulnerabilities to break in and were hyper-diligent in trying to cover their tracks once inside.\u201d\u00a0<\/strong><\/p>\n

Cybersecurity in the Water Sector<\/strong><\/h2>\n

Among the nations over 54,000 water facilities, there is little in the way of mandated cybersecurity policy. A mere 444 systems serve over half the population, while 85% are municipally owned<\/a>, with 90% of wastewater plants under local jurisdiction as well. Noted Suzanne Spaulding<\/a>, chief cybersecurity official at the Department of Homeland Security under the Obama administration, “When I first came into DHS and started getting the sector-specific briefings, my team said, ‘Here’s what you’ve got to know about water facilities: When you’ve seen one water facility, you’ve seen one water facility.'”<\/p>\n

According to the WaterISAC survey \u201cWater and Wastewater Systems Cybersecurity State of the Sector 2021\u201d<\/a>, \u201c60% of water utilities say they have not fully identified IT-networked assets in their networks, and only a little more than 21% of those utilities said they are working to do so.\u201d Add to that the fact that \u201croughly 70% said they have not fully identified all operational technology networked assets\u201d and the case can seem pretty dismal. Meanwhile, other CNI sectors like electricity<\/a> continue to expand and improve unifying cybersecurity standards.<\/p>\n

However, good moves are being made. According to a 2018 survey of these independent water facilities, 91 percent<\/a> have active cybersecurity programs. That\u2019s a great start. The White House hosted a Cyber Security Summit<\/a> back in August, and earlier this year, the Biden administration<\/a> announced plans to address the cybersecurity of water and wastewater systems.<\/p>\n

Already in place is America\u2019s Water Infrastructure Act, or AWIA<\/a>. Passed in 2018, it \u201cdeepens infrastructure investments\u201d and provides \u201cthe most far-reaching changes to the Safe Drinking Water Act since the 1996 Amendments.\u201d It claims over 30 mandated programs, and underpins cybersecurity frameworks established for the water industry, such as the one developed by WaterISAC.\u00a0<\/strong><\/p>\n

Essential Frameworks for Water Cybersecurity<\/strong><\/h2>\n

In an effort to strengthen the security posture of our nation\u2019s water utilities, and compliant with the standards in the AWIA, WaterISAC released their 15 Cybersecurity Fundamentals for Water and Wastewater Facilities<\/a>. These practices secure the information technology (IT) and operational technology (OT) systems that support national water and wastewater management. A summary can be found here<\/a>, and recommendations include:<\/p>\n