Water utility cyberattacks highlight a hard truth

Basic access control failures threaten critical infrastructure

Federal authorities are investigating cyber incidents affecting US water utilities, but security experts say the most important lesson for IT leaders isn’t who launched the attacks. It’s how critical systems remain exposed to preventable access-control failures.

Recent cyberattacks targeting US water and wastewater utilities are renewing serious discussions about operational technology (OT) security, but security experts are advising IT leaders to focus less on the geopolitical aspects of these reports and more on conditions that allowed them to happen.

The FBI recently announced that malicious cyber actors were targeting internet-facing programmable logic controllers (PLCs) at multiple water and wastewater facilities, resulting in operational disruptions.

In some of the incidents, the utilities lost visibility into plant operations and experienced disruptions that impacted normal functions.

Much of the news focus has been about who is behind the attacks, with many speculating this is a nation-state attack tied to Iran. However, Tim Tipton Jr, an operational technology and industrial cybersecurity expert, argues that geopolitics should not distract organisations from understanding the circumstances that made these attacks possible.

“Nobody exploited anything. They just changed passwords,” Tipton said in a video interview with MES Computing.

Tipton also challenges conventional thinking about the way organisations evaluate cyber risk and why some critical infrastructure facilities remain vulnerable despite significant cybersecurity investment.

Watch the full interview below for Tipton’s analysis and his recommendations for midmarket CIOs, CISOs, and infrastructure leaders.

Video: Tim Tipton Jr breaks down the water utility cyberattacks

Were these incidents the result of sophisticated nation-state activity, or do they indicate a more basic security problem?

In this MES Computing Interviews video, OT security expert Tim Tipton shares his perspective on what organisations may be missing in the news reports and what IT leaders can take away and apply to their own security strategies.

Security experts highlight remote access risks

The incidents come as the US National Institute of Standards and Technology (NIST) releases guidance aimed at helping water utilities secure remote access.

NIST recommends restricting remote access, enforcing multifactor authentication, and maintaining detailed access logs.

Mike Carr, field CTO at Xona Systems, said remote connectivity continues to represent one of the largest cybersecurity challenges facing the sector.

“NIST is right to call remote access the water sector’s biggest cybersecurity weakness. We’re seeing exactly that in the field every day,” Carr said.

Carr argues that many recommended security architectures still rely on software controls that reside on the same networks attackers are trying to compromise.

“Instead of trying to make remote access more secure, organisations should be looking for ways to eliminate the remote attack surface altogether,” he said.

Budget constraints complicate security improvements

For utilities, challenges extend beyond technology. Aging infrastructure and limited budgets are hurdles to overcome when developing long-term modernisation plans.

Security experts say those organisations should focus on more cost-effective risk reduction measures: tracking which systems are internet-connected, reviewing remote access policies, and prioritising critical assets.

While these incidents happened in the water sector, the takeaways apply across all industries.

From manufacturers to education, organisations should leverage the moment to evaluate their own environments for potential areas of exposure before attackers do.