EPA Warns States of Cybersecurity Threats to Water Systems: Task Force and Resources Announced

The Environmental Protection Agency (EPA) has issued a warning to states about potential cyber attacks targeting specific water system equipment with security vulnerabilities. The hackers, affiliated with the governments of Iran and China, have been identified as the culprits behind these attacks. In response, the EPA has announced the formation of a Water Sector Cybersecurity Task Force to address these threats.

The Cybersecurity and Infrastructure Security Agency (CISA) has also issued alerts detailing the equipment at risk and providing recommendations on how to mitigate the vulnerabilities. While no significant impact has been reported on any water system, the potential for future attacks remains a concern.

To combat these threats, the American Water Works Association (AWWA) has developed no-cost resources to help improve cybersecurity in the water sector. AWWA’s Kevin Morley emphasized the importance of collaboration and shared resources in addressing cybersecurity challenges in the industry.

Morley highlighted the need for increased awareness and utilization of tools like CISA’s free vulnerability scanning service, which has shown a significant reduction in vulnerabilities for utilities that have enrolled. Additionally, AWWA has created a risk management tool aligned with the National Institute of Standards and Technology’s cybersecurity framework to help utilities assess and address their cybersecurity needs.

Moving forward, Morley stressed the importance of knowledge transfer and governance in strengthening cybersecurity practices across all water systems. He recommended the development of minimum cybersecurity practices with oversight from the EPA to ensure the resilience of America’s water systems against cyber threats.

Overall, the collaboration between government agencies, industry organizations, and utilities is crucial in safeguarding the nation’s water infrastructure from cyber attacks. By working together and utilizing available resources, the water sector can enhance its cybersecurity defenses and protect the essential services it provides to communities across the country.