{"id":3397,"date":"2022-05-09T15:05:16","date_gmt":"2022-05-09T15:05:16","guid":{"rendered":"https:\/\/itegriti.com\/kw022024\/?p=3397"},"modified":"2022-10-17T14:55:21","modified_gmt":"2022-10-17T14:55:21","slug":"waterisac-state-of-the-sector-2021-us-water-industry-in-hot-water-when-it-comes-to-cybersecurity","status":"publish","type":"post","link":"https:\/\/itegriti.com\/kw022024\/2022\/compliance\/waterisac-state-of-the-sector-2021-us-water-industry-in-hot-water-when-it-comes-to-cybersecurity\/","title":{"rendered":"WaterISAC State of the Sector 2021: US Water Industry in Hot Water When it Comes to Cybersecurity"},"content":{"rendered":"

The water industry is one of 16 Critical National Infrastructure (CNI) sectors, which means it\u2019s on the front lines of nation-state cyberattacks when they come (and we\u2019ve been warned<\/a>). But is it ready? Survey says \u2013 not enough. About this time last year, the Water Sector Coordinating Council \u2013 made up of WaterISAC<\/a>, national water and wastewater associations, and the sector\u2019s research foundation – conducted a survey of the US water and wastewater sector<\/a> to assess cyber readiness. The results? Not exceptional. The problem? Today\u2019s threats are.<\/p>\n

Why cybersecurity is an urgent concern for water<\/strong><\/h2>\n

Why is now a good time for the water industry to perform a cyber health check? Because it\u2019s under attack. In a joint security alert<\/a> issued just weeks ago by CISA, the NSA, the FBI and the Department of Energy warned that \u201ccertain advanced persistent threat (APT) actors have exhibited the capability to gain full system access to multiple industrial control systems (ICS)\/supervisory control and data acquisition (SCADA) devices.\u201d In other words, there is evidence that bad actors are already able to breach US critical infrastructure systems, and that\u2019s on the heels of other joint advisories, government warnings, and the Biden Administration\u2019s 2022 100-day sprint to shore up cyber defenses for the water industry. It\u2019s urgent, and the information provided in this survey can serve as a baseline for future water sector cybersecurity improvements.<\/p>\n

The report states that there are \u201capproximately 52,000 community water systems and approximately 16,000 wastewater systems in the United States.\u201d That\u2019s an incredibly large surface area, which leaves it little room for error. Unfortunately, errors, weaknesses, and vulnerabilities abound.<\/p>\n

\u201cLike all sectors, water and wastewater systems are targets, directly or indirectly, of cyber attackers,\u201d continues the report, \u201cbut complicating any set of solutions is the demographics of the sector.\u201d What demographics? It goes on to state that \u201cmany [US water systems] are subject to economic disadvantages typical of rural and urban communities. Others do not have access to a cybersecurity workforce. Operating in the background is that these utilities are struggling to maintain and replace infrastructure, maintain revenues while addressing issues of affordability, and comply with safe and clean water regulations.\u201d To sum up, the water industry is:<\/p>\n

    \n
  1. On the front lines of attacks, as a key sector of CNI.<\/li>\n
  2. Understaffed, under-regulated, and underfunded, making it unprepared to deal with the incoming and precipitant threats.<\/li>\n
  3. Already vulnerable to nation-state Advanced Persistent Threats (APTs) which have been shown to lurk within its systems already.<\/li>\n<\/ol>\n

    You see the dire need then for the water industry to take stock of itself and find out where it stands in terms of cyber readiness – assessing strengths, weaknesses, and how it can improve. That\u2019s what this survey aims to do.<\/p>\n

    A \u201cfirst-of-its-kind” snapshot<\/strong><\/h2>\n

    The Water Sector Coordinating Council<\/a> is \u201ca policy, strategy and coordination mechanism for the Water and Wastewater Sector in interactions with the government and other sectors on critical infrastructure security and resilience issues.\u201d It is one of a number of sector coordinating councils<\/a> for critical infrastructure.<\/p>\n

    The State of the Sector 2021 survey<\/a> it put out in April of last year was significant because it had never been done before. Cited as a \u201cfirst-of-its-kind snapshot of the Water and Wastewater Systems Sector cybersecurity posture,\u201d it canvassed 606 responses from the water and wastewater industry and was crafted to \u201cdevelop a picture of current cybersecurity practices in the sector\u201d for the purpose of guiding policy, informing dialogue and improving security policy. Let\u2019s see how it did.<\/p>\n

    Survey results<\/strong><\/h2>\n

    We can break the results down into a few key areas:<\/p>\n