Cyber security is a Thing at Water plants

Among the big events in the past month are two issues that affect water and sewer utilities.  The first was a hack of the Oldsmar water plant in early February.  The hacker accessed the plant controls and adjusted a chemical feed system, which created a potential health risk to the community.  The good news is an operator noticed that something had changed and called authorities.  The FBI confirmed the hack.  So how did that happen and can it happen again?

Technology is great, but it cuts two ways.  The first is that it allows us to gain data on our systems and to use that information to improve operations.  As time has marched on, operators and others have sought more and more data, and more people have wanted to access and use that data.  Administrators, public safety, regulatory agencies sand others all have asked for access as they saw the opportunities.  And as the systems have become more complex and more access is needed, there is more need for access to IT personnel and others to maintain the system through backdoor access points.  That means wired and telephonic access, which opens the doors for unauthorized people to access the system. 

One operator’s solution is to pull the wires out of the wall, and remove the blue-tooth access.  So, no electronic access.  He has argued that administrators do not need access as the plant is staffed 24/7.  The site has cameras and alarms note on the exterior walls and inside.  Those are patched to police, but not the operator computers.  No phone access to operations either at the plant. 

He has a point.  Access to real time data is great, but carries a risk.  He is not willing to take the risk or put his customers at risk.  What is the value of 24/7 real time access to people not on the plant site?  It’s not like they are making operating decisions from home.  Nor are they needing data for analysis and reports over the weekend.  We can get that data directly from the plant when we need it.  Do we really need all this access?  We need to think about this.

For years the federal government has been concerned about foreign and domestic hackers interfering with the power grid.  The water sector is less considered but just as critical.  Hackers have been able to penetrate the grid on a number of occasions.  It creates significant potential for economic and social challenges.  We need look only at the aftermath of hurricanes or the recent snowfall in Texas to understand the challenges with a grid shutdown.  Hackers can do the same.  Even shorter term impacts like the 2003 northeast Blackout can create a problem.  Longer term impacts can wreak havoc on society.