A very real threat
Ever since the infamous Stuxnet cyberattack destroyed Iranian uranium processing capabilities a decade ago, industrial control systems have been a known target for cybercriminals.
For the water industry, cyberattacks represent a very real threat.
There has been a spate of events over the last few years, most recently in Israel where an attack in April saw a serious attempt to increase the chlorine content in drinking water. Even more recent attacks have been reported.
According to a new analysis from Cisco Systems and Jacobs Engineering, the adoption of new technologies such as digital networks, remote operations, real-time data acquisition and analytics, means water systems are not as digitally secure as they used to be.
As a result, the door has been opened to substantial cyber risks for critical infrastructure.
The changing nature of cyberattacks
Attempting to address this issue, the 2018 America's Water Infrastructure Act requires US water systems serving more than 3300 people to develop or update their risk assessments and emergency response plans, including operational technology cybersecurity.
However, for many water utilities, even those serving many thousands of individuals, there are no such legal requirements.
Perhaps even more troubling, many such utilities do not seriously consider the risks associated with the changing nature of cyberattacks.
“The risk to the water industry is that cyber is changing,” says Barry Searle, director of training at Intqual Pro.
Speaking to Aquatech Online, he says: “It’s moved from IT and data theft to disruption of operational technologies for criminal purposes. There has been a big shift.”
“Threat groups have realised that if they can limit access to critical systems like SCADA, they can make a lot more money.”
He added: “Previously attacks were all about data theft, but in the past two to three years that has changed to denial of service attacks. Threat groups have realised that if they can limit access to critical systems like SCADA or operational technology, they can make a lot more money."
Ensuring reliable and robust security
A cultural shift is required
“Financial services are 10 years ahead of water…I am not seeing the same level of investment or engagement in the water industry.”
This will likely require something of a cultural shift, according to Searle.
