EPA puts teeth into water-sector cyber efforts

Nearly 70% of the United States’ community drinking water systems fails to comply with the Safe Drinking Water Act, according to the Environmental Protection Agency (EPA) — including the cybersecurity standards that it lays out. New EPA enforcement plans aim to turn that around.

According to an EPA alert out this week, Russia and Iran in particular have stepped up cyberattacks on the nation’s water systems, “to a point where additional action is critical.” The agency pointed to a rash of critical cybersecurity vulnerabilities of concern, including default passwords that have not been updated and single logins that can easily be compromised.

The stakes are notably high. “Possible impacts include disrupting the treatment, distribution, and storage of water for the community, damaging pumps and valves, and altering the levels of chemicals to hazardous amounts,” the agency said.

In response, the EPA said it would increase the number of planned inspections to ensure that water systems are regularly assessing their cybersecurity resilience and developing emergency response plans. As part of the initiative, the EPA released its “Top Actions for Securing Water Systems” outline, which includes the following steps:

The agency also said that it’s establishing a task force to identify additional near-term actions and strategies to reduce cyber-risk for water and wastewater systems nationwide; and, where appropriate, it also said it will take civil and criminal enforcement actions if systems don’t get their acts together.

Ongoing Attacks, Concerns, for Water Sector

The alert is just the latest in a series of alarms on water cyber safety sounded by the feds in recent months, in response to attacks like one last November on the Municipal Water Authority of Aliquippa in Pennsylvania by an Iranian state-sponsored group called CyberAv3ngers. In its alert, the EPA didn’t offer specifics of recent attacks, but noted that “foreign governments have disrupted some water systems with cyberattacks and may have embedded the capability to disable them in the future.”

To read the complete article, visit Dark Reading.