EPA will step up inspections of water sector cybersecurity

A new enforcement alert said that the majority of inspected water systems do not fully comply with federal requirements.

The Environmental Protection Agency issued an alert Monday warning the nation’s water utilities that as cybersecurity threats continue to rise the agency will also increase its security-focused inspections and enforcement activities.

The EPA said in a statement that the agency has found that more than 70% of inspected water systems do not fully comply with certain security requirements in the Safe Drinking Water Act (SDWA). Some of the water systems are missing basic cybersecurity practices, the agency said, such as not relying on default passwords and not using multi-factor authentication.

The EPA said that attacks on the water sector “have increased in frequency and severity to a point where additional action is critical.”

“Protecting our nation’s drinking water is a cornerstone of EPA’s mission, and we are committed to using every tool, including our enforcement authorities, to ensure that our nation’s drinking water is protected from cyberattacks,” EPA Deputy Administrator Janet McCabe said in the statement. “EPA’s new enforcement alert is the latest step that the Biden-Harris Administration is taking to ensure communities understand the urgency and severity of cyberattacks and water systems are ready to address these serious threats to our nation’s public health.”

A series of incidents over the past year has shown just how vulnerable water systems in the United States are to malicious hackers. In April, Russian hacktivists targeted several water systems in Texas, including one incident that caused a utility in Muleshoe to experience an overflow, although services remained operational. 

While the attacks themselves were fairly pedestrian – highlighting just how easy it is for  nation-backed hackers to hack U.S. water systems – security researchers have linked the hacktivists to Sandworm, Russia’s most notorious hacking group that has repeatedly brought down Ukraine’s grid.

In November, an attack on the Israeli firm Unitronics, which manufactures industrial control equipment, resulted in programmable logic controllers used in U.S. water systems being defaced. The defacements were claimed by the Cyb3r Avengers, which officials have linked to the military intelligence arm of Iran’s Islamic Revolutionary Guard Corps.

The EPA said that many inspected utilities have failed to conduct risk and resilience assessments or develop emergency response plans, both of which are called for under the SDWA. The agency is planning on stepping up the number of inspections of community water systems, a term used for systems that provide drinking water to the same area year-round and serve more than 3,300 people.

The EPA said it has already taken more than 100 SDWA enforcement actions against those water systems since the 2020 deadline to develop risk assessments and response plans and warned that it will continue to use enforcement authorities to “address the problem quickly,” warning that  criminal sanctions are possible in response to false certifications.

The agency has tried to impose cybersecurity mandates on the sector before. Last year, EPA issued an update that would require utilities to follow new cyber rules but held off after legal challenges from several states and water trade associations through existing state sanitation laws. Opponents to the rule said the agency overstepped its authority.

Industry groups like the American Water Works Association have been advocating for a new body to take the role of federal regulator for the water sector modeled after the electric sector. Reps. Rick Crawford, R-Ark., and John Duarte, R-Calif., recently introduced a measure known as the Water Risk and Resilience Organization Establishment Act, which would create such a governing body with a specific focus on both cybersecurity and water systems.

The EPA and the White House recently sent a letter to governors both to warn about the cyber threats to water systems and to invite state officials to a meeting with EPA and White House officials. The letter pointed to threats like the Chinese-linked hacking group dubbed Volt Typhoon, which administration officials might seek to disrupt U.S. critical infrastructure in the event of a conflict between the United States and China.

In most cities, nobody owns the whole network

July’s intrusions reached water controllers that sat on a cellular link no city network scan would find. Naming an owner and paying for the fix are decisions…

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems