Increasing Cyber Threats to Water Utilities

Hackers exploiting artificial intelligence (AI) to breach water utilities pose a real threat, says cybersecurity expert John Walsh. These breaches could alter water treatment processes. AI helps attackers find vulnerabilities faster than defenders can fix them.

Urgency of Threats

Walsh, from cybersecurity firm IGEL, told Newsweek that AI accelerates cyber threats against operational technology systems like those in water treatment plants and energy facilities. These systems have long been targets of malicious actors. Recently, geopolitical tensions and advancing AI escalate the urgency.

“We face a geopolitical situation targeting infrastructure,” Walsh stated. “AI increases how quickly incidents occur.” The intersection of geopolitical issues and AI heightens the need for action.

Vulnerable Water Systems

Cybersecurity experts worry about water and wastewater systems, many of which local governments run with limited resources and outdated infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) issued warnings about threats to key systems like Siemens’s programmable logic controllers (PLCs). These are common in water treatment plants, energy, and chemical facilities.

“Targeting Rockwell, Schneider, and Siemens affects 70% of controllers,” Walsh explained. These run chemical, energy, and other facilities in addition to water systems.

Consequences of these attacks could extend beyond temporary disruptions. “Water disruptions can affect farming and food production,” Walsh pointed out, highlighting the reliance of modern agriculture on industrial control technologies.

Patterns of Attack

Federal agencies have long warned of cyber threats to water infrastructure. Walsh emphasized increased attacks on industrial control systems linked to Iranian and other nation-state actors. “Our industry has faced this for years,” he said, citing a pattern of attacks from recent history.

Attacks use industrial platforms from companies like Rockwell and Siemens. He mentioned a UK power facility attack as an example of inertia of this threat.

“Many small utilities may be especially vulnerable due to limited staff and budgets,” Walsh noted. “They might present easier targets.”

Potential Attack Unfolding

Hackers may alter industrial control systems without operators knowing. Water treatment relies on PLCs to perform automation like opening valves and controlling chemical processes.

“In the water supply, chemicals purify the water based on specific measurements,” Walsh explained. A cyberattack may mislead operators into thinking systems function properly.

He compared this to the Stuxnet attack on Iran’s nuclear program. “Operators believed everything was running well when it was not,” Walsh said.

Criminals and nation-states might aim to disrupt services or manipulate treatment processes. “Understanding the adversary’s objective is vital,” Walsh urged. “Was the goal to shut down operations or poison water chemically?”

Accelerating AI Threat

AI transforms cybersecurity by rapidly identifying and exploiting vulnerabilities. Nation-states can acquire industrial technologies and use AI to uncover weaknesses.”AI accelerates the adversary’s ability to identify vulnerabilities,” Walsh noted.

“AI helps modify attacks quickly enough to evade traditional cyber defenses,” he stressed. “The pace of zero days is challenging to match.”

AI defends and detects threats, but detection alone is not enough. “The traditional detect, patch, respond model is insufficient,” Walsh argued, urging a more prevention-based security approach.

AI systems themselves need security controls, or criminals could mislead their models. “We must slow down and ensure governance over AI,” he advised.

Consumer Actions

Walsh reassured that average Americans are unlikely targets in these high-level cyberattacks. However, individuals can enhance personal cybersecurity and advocate for community protections.

Walsh recommended multi-factor authentication, password management, and vigilance against phishing. “Lack of multi-factor authentication leaves you vulnerable,” he said.

He encouraged consumers to pressure local officials to invest in cybersecurity for water systems, making security standards mandatory, similar to historical automotive safety advancements.

“We must push local communities and governments to enforce necessary protections,” Walsh stated. “Budgets must reflect these security needs.”

While some opt for personal water filtration systems, Walsh emphasized that the ultimate solution is securing public infrastructure.