Water And Wastewater Utilities At High Risk Of Cyberattack

Cyberattacks pose a greater threat to water and wastewater utilities than most other industrial sectors.

Federal cybersecurity overseers at the Homeland Security Department say they received 159 reports last year involving "vulnerabilities in control systems components. The majority of vulnerabilities that were coordinated involved systems most commonly used in the Energy Sector, followed by Critical Manufacturing and Water and Wastewater."

Of all the 245 cyber threat incidents reported by asset owners and industry partners last year, 14 came from the water sector.

Wastewater and water utilities are drawing an increasing amount of attention from cybersecurity overseers. The number of onsite cybersecurity assessments conducted by ICS-CERT, an organization within the Homeland Security Department, is on the rise. It conducted 25 in 2011, 72 in 2013, and 38 in 2014. This year, it conducted 21 onsite cybersecurity assessments within the wastewater and water sector during March and April alone.

Across industry, the rate of cybersecurity threats is going up. Nearly 70 percent of critical infrastructure companies surveyed by Ponemon Institute "suffered a security breach in the last year,"Info Security reported in 2014.

Last year, ICS-CERT said the number of vulnerability reports for control systems components across all industries had risen 15 percent since 2011. And, "cyber attacks on industrial targets such as water and wastewater treatment plants in 2014 increased more than 25 percent since 2011," Environmental Leader reported this month, citing ICS-Cert.

ICS-Cert offered a hopeful message about its plans for2015 in its annual report last year. "It is uncertain what new cybersecurity threats will emerge in 2015, but ICS-CERT stands prepared to meet the challenge and help [critical infrastructure] asset owners prevent attacks or mitigate their harmful effects."

ICS-Cert releases data about cyber threats in ISC-CERT Monitor,among other public reports. It also provides timely updates to critical infrastructure owners about potential cyber threats, available here.