Water: The (Potentially) Most Cyber-Resilient CI Sector
Examines water: The (Potentially) Most Cyber-Resilient CI Sector and evaluates key implications for security practitioners.
Summary
Sector Scale and Security Gaps
The U.S. has 143,000 public water systems with uneven cyber risk. Many small non-community systems lack external connectivity, but community systems face poor security engagement—under 1% adopted free CISA scanning or EPA assessments despite outreach.
Regulatory and Budget Constraints
Without federal cyber regulations and with limited budgets, utilities prioritize compliance-mandated work over voluntary security. High-profile disruptions by groups like Cyber Army of Russia Reborn illustrate the sector's exposure.
Built-in Resilience
Water tanks buffer hours of demand during treatment or pump failures, giving operators time before customer impact. A Massachusetts survey found most utilities can run manual operations, and frequent boil orders and pipe breaks mean operators routinely handle disruptions.
Practical Security Measures
Recommended approaches include independent data loggers parallel to SCADA for tamper detection, reconsidering always-on remote access when alarm-only monitoring suffices, and contingency plans for partial manual operation when PLCs are unavailable.
Related talks
S4 Events·51 min
Gus Serino
Analysts investigate attack surfaces and defenses concerning Water Sector Cyber Risk with Gus Serino.
S4 Events·52 min
Security researchers examine technical aspects of The Water Sector (Uniqueness, Cloud, Oldsmar, NERC CIP).
FIRST·35 min
Presenters detail vulnerability discovery and exploitation in Building Capacity in Critical Infrastructure Sectors.