Cyberattacks on critical infrastructure are on the rise, and water utilities can be particularly vulnerable. Staff from dozens of water utilities across Alabama recently met in Birmingham for two days of training with cybersecurity experts.
One expert who gave a presentation was Stephanie Watt, the Alabama coordinator for the U.S. Homeland Security Department’s Cybersecurity and Infrastructure Security Agency. Watt talked about edge devices – hardware or systems that sit on the boundary between a utility’s private network and the public internet. They mediate incoming and outgoing traffic.
“If you don’t have those devices secured, or you’re using default passwords, weak passwords, that’s like a bad guy walking up to the window and being able to lift it up and crawl right in, right?” she said.
That’s what happened when attacks on water systems in multiple states this summer threatened drinking water. Cyberattacks on water utilities can cause a loss of water supply or change the cocktail of treatment chemicals that makes water safe to drink – while spoofing normal readings so system operators are unaware anything is amiss. Some cyber criminals also try to extort ransom payments.
AI increasing risks
Artificial intelligence is accelerating the rate at which hackers can find and take advantage of weak spots in computer software and systems. Meanwhile, most water utilities don’t have the resources or IT staff to adequately prepare, said Nick Sellers, associate director and chief operating officer of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security.
“It is moving so fast,” Sellers said. “It's the speed that adversaries, that these attackers are using, whether it's a nation state or whether it is a criminal syndicate. Everything is connected to our networks now.”
The free training event is all about sharing best practices and making sure water utility staff know who to call and what to do if there’s a cyberattack, Sellers said.
The McCrary Institute is one of several organizations that partnered to put on the event, which Central Alabama Water hosted at its Cahaba Pump Station.
In addition to presentations, the training included tabletop exercises that simulate real-world cyberattacks and responses. Chad Smith, chief information security officer for the state of Alabama, said that aspect of the event was especially important.
“It actually puts you in a real-world scenario where you can test the sort of muscle memory that you need to have in place and how you respond,” Smith said.
Federal funding to assist utilities could end
In addition to participating in the training event, the McCrary Institute uses federal funding to help water utilities in Alabama with cybersecurity on a regular basis. The state of Alabama partnered with the institute to use funds from the State and Local Cybersecurity Grant Program to create and run a program for that purpose. Sellers said about 135 of 400 water systems in the state are participating.
“Bad guys have an unfair advantage right now, but through this partnership, real-time threat intelligence, training on what we do when a bad thing happens and how we get back online quickly, is going to be the game changer. It's how we level the playing field,” Sellers said.
The federal dollars that support the program could be disappearing soon. An extension of the federal grant program lapsed on Sept. 30, and Congress would have to reauthorize it. Smith said his office is imploring Congress to keep the funding going so programs can continue.
What role can states play?
With federal funding in jeopardy, states might need to fill in more gaps.
The Pew Research Center released an analysis last month that examines policy and funding strategies states are pursuing to address cybersecurity threats.
Mollie Mills, an officer with Pew's State Fiscal Policy Project, said states typically fall into one of three buckets when it comes to helping water utilities prepare for cyberattacks.
One group is serving in a supportive role by directing utilities to resources provided by CISA and the U.S. Environmental Protection Agency. They might also provide information and some technical assistance. Mills said Alabama falls into this category.
A second group of states is issuing administrative rules or passing legislation with cybersecurity-related requirements such as mandatory training and emergency response plans.
"There's also a third category of states that may be doing some of those other things, too, but is also providing dedicated funding for it," Mills said. "New York's a good example of that. They have a grant program that they're pairing with their requirements to help utilities pay for compliance costs."
She said water utilities have been left to shoulder much of the financial burden for cybersecurity on their own. And they're already juggling a lot of expensive tasks.
"Cybersecurity is just competing with a lot of visible and legally required projects, such as replacing aging pipes, meeting water quality standards, fixing routine equipment, and so I think the problem ultimately comes down to capacity and these competing infrastructure priorities," Mills said.
That's something state leaders need to pay attention to, she added.
"In general, states just need to make sure that they're thinking about how these systems are going to pay for these kinds of improvements, so that it's not all getting passed to ratepayers and customers," Mills said.
Birmingham-area water utility takes cybersecurity steps
Central Alabama Water, which serves the Birmingham area and is the state’s largest water utility, has made moves recently to increase cybersecurity. It hired a cybersecurity consultant in August, and when its board of directors emerged from a non-public meeting on Oct. 9, members voted to adopt three unnamed security measures.
Board Vice Chairman Phillip Wiedmeyer said CAW can’t share details because that would show its hand to the hackers.
