Water and wastewater systems across the U.S. are vulnerable to cyber attacks, threatening their abilities to carry clean, potable water to their communities and provide sewer services, according to the federal government.
The FBI, NSA, Cybersecurity and Infrastructure Security Agency and the Environmental Protection Agency published a joint advisory on Thursday, advising municipal water organizations to strengthen their cyber infrastructure and implement other security measures to protect themselves from future attack.
The risk became real this summer, when Limestone and Mount Desert’s wastewater systems were hacked after ransomware hackers improperly accessed the agencies’ computers.
Some Maine wastewater agencies have been able to adapt and update their operations to safeguard themselves from potential attack.
The Bangor Water District strengthened its firewall and improved its password systems after hackers exploited a Florida water treatment plant’s outdated computer apparatus and tampered with a city’s water supply earlier this year, said Kathy Moriarty, Bangor Water District’s general manager.
The water district also conducted more training with its employees and strengthened internal protocols, Moriarty said.
The Greater Augusta Utility District is one of the few water departments that employs a full-time IT person who works to mitigate some of these threats after ransomware hackers targeted the Augusta City Center two years ago, said Brian Tarbuck, the general manager of the Greater Augusta Utilities Department.
The IT staffer works to minimize the number of “attack surfaces,” or points of entry where bad actors can potentially intrude upon the department’s operations, Tarbuck said.
The utility district has worked to separate its business office systems from its industrial control systems, he said.
That allows utility district employees to still view system data in real time, even if other operations are disturbed. If communication between wells and water tanks were cut, for example, “it ensures we can see how much water is coming out, we can see the chlorine residual that we’re trying to target, [and] we can see how much water is in the tank,” Tarbuck said.