EPA Puts Teeth Into Water Sector Cyber Efforts

Nearly 70% of the United States' community drinking water systems fails to comply with the Safe Drinking Water Act, according to the Environmental Protection Agency (EPA) — including the cybersecurity standards that it lays out. New EPA enforcement plans aim to turn that around.

According to an EPA alert out this week, Russia and Iran in particular have stepped up cyberattacks on the nation's water systems, "to a point where additional action is critical." The agency pointed to a rash of critical cybersecurity vulnerabilities of concern, including default passwords that have not been updated and single logins that can easily be compromised.

The stakes are notably high. "Possible impacts include disrupting the treatment, distribution, and storage of water for the community, damaging pumps and valves, and altering the levels of chemicals to hazardous amounts," the agency said.

In response, the EPA said it would increase the number of planned inspections to ensure that water systems are regularly assessing their cybersecurity resilience and developing emergency response plans. As part of the initiative, the EPA released its "Top Actions for Securing Water Systems" outline, which includes the following steps:

The agency also said that it's establishing a task force to identify additional near-term actions and strategies to reduce cyber-risk for water and wastewater systems nationwide; and, where appropriate, it also said it will take civil and criminal enforcement actions if systems don't get their acts together.

Ongoing Attacks, Concerns, for Water Sector

The alert is just the latest in a series of alarms on water cyber safety sounded by the feds in recent months, in response to attacks like one last November on the Municipal Water Authority of Aliquippa in Pennsylvania by an Iranian state-sponsored group called CyberAv3ngers. In its alert, the EPA didn't offer specifics of recent attacks, but noted that "foreign governments have disrupted some water systems with cyberattacks and may have embedded the capability to disable them in the future."

The government, despite anti-regulation pushback from water industry groups, has also made moves like proposing $7.5 million in new cybersecurity funding for rural water systems.

Chris Warner, OT security strategist at GuidePoint Security, says that part of the persistent problem is that sector-specific cybersecurity expertise is hard to come by.

"The challenge in the security of our water and wastewater facilities is a shortage of qualified OT security personnel, and IT security’s challenges in understanding the control systems that operate water systems pose significant challenges," he explains. "To address these issues, forming cross-functional teams, collaborating with Critical Infrastructure Sector Liaisons, and building strong relationships with local law enforcement are crucial."

To address that specific need, the EPA said that it's working with CISA to offer guidance, tools, training, resources, and technical assistance to help water systems harden their cyber postures. CISA in January also released an extensive, 27-page water sector-specific guide for cybersecurity best practices.

Warner notes that it's imperative that the feds continue to shine a spotlight and take an active role in water and wastewater cybersecurity.

"These measures can enhance coordination, improve response times, and provide a comprehensive approach to securing water systems," he says. "Without such mandates and collaborative efforts, the risk of attacks on critical infrastructure, including water and wastewater systems, increases significantly."