Written by The Realist Juggernaut Staff
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a fresh warning about the ongoing threat to water systems, citing continued attacks by cybercriminals and hostile nation-states. This advisory came just days after a cybersecurity incident disrupted operations in Arkansas City, Kansas, forcing the town to revert to manual control of its water systems.
CISA reported that it is actively addressing the exploitation of internet-accessible operational technology (OT) and industrial control systems (ICS), which include critical infrastructure like water and wastewater systems. According to the agency, many of these systems are exposed and vulnerable, allowing cyber actors to use default credentials or brute force attacks to gain access and cause potential harm.
“Exposed OT/ICS systems provide cyber threat actors opportunities to exploit weaknesses through basic methods, which can lead to serious consequences,” CISA stated, urging water system operators to implement previously recommended security measures.
The recent incident in Arkansas City, a town of about 11,000 residents, began on Sunday morning. Although City Manager Randy Frazer refrained from confirming whether the FBI and CISA were involved in responding to the attack, he assured residents that the water supply remained safe and that no service disruptions had occurred. “As a precaution, the Water Treatment Facility switched to manual operations while the situation is being addressed. The safety of drinking water remains intact, and the City is under full control,” Frazer said.
Frazer mentioned that cybersecurity experts, alongside government authorities, are currently working to resolve the issue but declined to provide further updates.
This incident underscores the ongoing debate about the role of federal and state governments in protecting the nation’s 150,000 public water systems. Despite an alarming rise in ransomware attacks and intrusions from nation-states, some water industry groups, including the American Water Works Association, have resisted federal oversight. They argue that the industry should retain the authority to establish its own cybersecurity guidelines.
Even after last year’s series of attacks on U.S. water systems, which were reportedly linked to Iran, many in the industry remain opposed to federal regulation. These attacks highlighted the vulnerabilities of industrial water systems, especially those that connect critical infrastructure to the internet for remote management purposes.
Lior Frenkel, CEO of Waterfall Security Solutions, emphasized that water system operators often overlook the risks associated with internet connectivity. “Systems that are connected to the internet can be shut down, manipulated, or compromised in ways that disrupt the processes they control,” Frenkel warned. He called for a shift in the default practice, suggesting that systems should be disconnected from the internet unless absolutely necessary.
As attacks on critical infrastructure continue to rise, the need for stronger cybersecurity protocols has never been more pressing. Water systems, vital to public health and safety, remain a key target for hackers and nation-states. CISA’s latest advisory serves as a reminder of the vulnerabilities that persist and the importance of taking preventive measures to safeguard these essential services.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
