Critical infrastructure security Is back in the headlines

Recent threats targeting water infrastructure and industrial control systems are renewing concerns about how communities, utilities and policymakers can work together to reduce cybersecurity risk.

Key takeaways

• Critical infrastructure remains an attractive target for cyberattacks. Recent incidents affecting water systems and warnings about threats to industrial control technologies highlight ongoing risks to essential public services. 
• Many local utilities face significant cybersecurity challenges. Limited budgets, aging equipment and increased internet connectivity can make it difficult for smaller organizations to implement modern security controls.
• Improving resilience will require both funding and community engagement. Legislative proposals, regulatory oversight and local cybersecurity expertise may all play a role in strengthening the security of critical infrastructure systems.

A suspected Iranian cyber campaign affecting water systems in at least 12 states in the U.S. has, for better or worse, brought renewed attention to how vulnerable critical infrastructure remains.

At the same time, U.S. agencies this week issued an advisory about threats to Siemens S7 Series programmable logic controllers (PLCs) that are widely used in critical infrastructure. The advisory says threat actors are using AI-generated exploitation scripts disguised as legitimate monitoring tools to target internet-exposed controllers running outdated software or otherwise lacking adequate protection.

In the wake of these attacks, Senators Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) have introduced the Water Cyber Shield Act, which would give the Environmental Protection Agency (EPA) the authority to assess cyber risks and require utilities to correct identified problems.

That effort follows a previously proposed Water Risk and Resilience Organization (WRRO) Establishment Act to create a governing body to work with the EPA to develop and enforce cybersecurity requirements for drinking water and wastewater systems.

Given the current political gridlock in Congress, the odds that any of this proposed legislation might gain passage are probably long. The sad truth is that an actual breach on one of these systems may be required before Congress develops the political will required to act. In the meantime, there are more than 50,000 community water systems managed mainly by cities or counties that typically lack the financial resources needed to secure them. In an ideal world, many of those systems would be replaced or modernized to improve security, but in the absence of funding most will continue to rely on outdated equipment that has often been connected to the internet without fully appreciating the cybersecurity implications.

There are, however, approximately 1.3 million employed cybersecurity professionals in the U.S. who live in those communities. While most of them are overworked, it might behoove us all if some of them took the time to attend the public meetings that are typically hosted by local government officials. Many of the people living in those communities don’t fully understand the scope of the threat to critical infrastructure and even in the age of the internet a face-to-face meeting is still the most effective way to share information and concerns. In fact, it’s those public meetings that are now at the heart of a data center resistance movement that has spread across the U.S.

Ultimately, any discussions about securing critical infrastructure come down to who should pay for it. Each local community funded the development of the various utilities that deliver water, power and other services so, theoretically, the cost of securing them should fall on them. However, it’s also arguable that it was the action of the federal government that, at least to some degree, put those systems in additional harm’s way. Regardless, any successful attack on a water system is going to result in a mass exit from one locality into another, with federal resources being used to facilitate it. As such, the fact that a water system in another town is insecure could eventually become everybody’s problem. It’s also clear that adversaries of the U.S. are all too aware of how soft the underbelly of critical systems in the U.S. really are.

As such, regardless of political affiliation securing critical infrastructure just might be an issue that everyone can support, provided that people are concerned enough to start doing something about it.