ROCHESTER, N.Y. – When cyber criminals launched attacks against computer systems at more than 100 public water systems in 12 U.S. states this summer, it served as a wake up call to system operators and their IT departments. New York state is sending millions of dollars to drinking water and wastewater treatment facilities to help beef up cybersecurity. System operators say staying ahead of so-called “bad actors” is a never-ending fight.
“I never thought of that,” said Donna Silverman. “I don’t think too much about cybersecurity with water sources, but I should.”
“I never really thought of it, as far as the cyber situation,” said Brad Sluman. “I tell you, these days, you have to be careful with everything.”
Especially after a series of cyberattacks targeting U.S. water systems, it’s something system operators already know.
Shoremont treatment plant is the beginning of the line for clean drinking water for 800,000 Western New Yorkers, and Ken Naugle has quite a responsibility.
“Our customers expect when they turn the tap on in their kitchen faucet, that safe, reliable water will come to them at any point in time,” said Naugle, the plant’s production engineer and water quality laboratory manager.
Monroe County Water Authority’s Shorement plant in Greece is built to handle up to 140 million gallons of water per day. MCWA is the third largest water authority in New York state, which runs largely on computers. It is operational technology, much of which we can’t show you. Plant operators don’t want to give potential bad guys any ideas.
“Cybersecurity has been an issue for some time now,” said Naugle.
Over the summer, hackers tied to Iran launched cyberattacks against more than 100 water treatment and wastewater systems in 12 U.S. states. It prompted system operators to look at their own first line of cyber defense — something they say they do frequently.
“We found that we’re in good shape,” said Naugle.
“It’s constantly evolving,” said Justin Moore, MCWA’s director of information technology. “We’re constantly having to keep up with the threat landscape, updating our technologies. That is one of the biggest challenges, making sure that we’re on supported technologies that continue.”
Cyber experts say critical infrastructure is a constant target for attacks because of the damage or disruption they can cause.
“The idea that there are these teenagers in the basement trying to prove that they have certain skills, and of course, that still exists, but it’s usually not about getting into a water treatment plant,” said Matthew Wright, professor and chair of cybersecurity at Rochester Institute of Technology.
Inside RIT’s Cyber Range, Wright showed a map, which displays in real time, attacks picked up by security detection systems around the world.
“When we look at coordinated attacks like what we’re seeing, that is much more likely to be a state or a government that is thinking strategically about what they can do at a large scale,” he said. “Especially when they’re in the middle of a conflict.”
Wright says smaller water facilities face a more serious cyber attack threat, especially in rural areas and small towns, which might have outdated equipment or a smaller IT staff.
“Their ability to do good cybersecurity is very limited,” said Wright. “And they also are under pressure, just like everybody else, to keep costs down.”
Earlier this year, Gov. Kathy Hochul announced what she described as “nation-leading” new cybersecurity regulations for drinking water and wastewater systems. The new regulations include cybersecurity training for system operators, multi-factor authentication and complex passwords for computer access, and a requirement that cybersecurity incidents are reported to the state.
“A lot of that is just not in place when it comes to these systems,” said Wright. “So we could do a lot better.”
The state has also sent tens of millions of dollars to water system operators across New York to help pay for cybersecurity upgrades. Earlier this year, Shoremont received $1 million in federal funding for cybersecurity improvements.
“It’s only recently that the threats have elevated in terms of their sophistication,” said Naugle. “And therefore, the need for additional requirements.”
According to a public records request from the New York State Department of Environmental Conservation, state environmental officials say since the new reporting regulations took effect at the end of March, there have been zero cyber attack incidents reported at water and water treatment systems in New York state.
Computer system safety and security is not just for the plant that ensures the water taken from Lake Ontario is safe to drink, but also the treatment plant which ensures wastewater is safe to put back out into the lake.
Mike Garland, director of Monroe County Department of Environmental Services, which is responsible for removing any nasty stuff from wastewater at its Van Lare treatment plant, says cyber security is constantly being upgraded.
“We have an isolated internal fiber optic network communication system that’s separate from the internet, separate from the outside,” said Garland. “And that ensures that we have a high degree of protection within our system.”
Protecting the system means getting it right every time.
“The threat landscape is constantly evolving,” said Moore. “It’s constantly changing, so we’re chasing a moving target.”
For hackers with bad intentions, one crack in the system is all it takes to reach the end of the line.
“That’s a position where you don’t want to be in, sitting there with your chin out, ready to take that punch,” said Wright. “You want to be defending yourself. And so it’s really important that we have the right cybersecurity controls in place to make sure that we’re not on the wrong end of those types of attacks.”