The FBI has warned that water utilities are actively being targeted and need to disconnect their systems from the internet, or “airgap” them, because that’s how hackers are getting in. (PHOTO: KATV)
LITTLE ROCK, Ark. (KATV) —The FBI has warned that water utilities are actively being targeted and need to disconnect their systems from the internet, or “airgap” them, because that’s how hackers are getting in.
Central Arkansas Water has for years done that and much more to protect its system, which serves about half a million people.
“We do have very robust multi-layer security in place that more than falls in line with what the FBI has recommended to water systems,” said Douglas Shackelford, Central Arkansas Water public affairs officer.
The recent wave of cyberattacks has mostly targeted small, municipal water utilities that have far fewer resources than Central Arkansas Water, older hardware, and poorly secured software.
Though no attacks have been reported here, it’s a wake-up call for Arkansas, which has around a thousand water systems, many of them just as vulnerable as those attacked in other states.
“Arkansas itself has hundreds of water utilities, individual water utilities. And they all require these digital components. And so protecting all of those is an enormous challenge because of that, you have so many opportunities for attack. And so it’s just a matter of finding the ones that are open, that are vulnerable,” said Philip Huff, a University of Arkansas at Little Rock computer science professor.
Hackers have been able to gain access through internet-exposed programmable logic controllers, or PLCs, like the one seen here. As their name suggests, these computers control water systems and other infrastructure.
“The devices that were targeted are what operate most of our critical infrastructure equipment, whether it’s an electric substation or a water treatment facility. These PLCs, they allow us to program what happens in the physical world. And that’s why it’s critical that we protect those,” Huff said.
The apparent ease with which malicious actors can hack critical infrastructure is concerning enough, but Huff said the recent attacks may be, forgive the expression, merely testing the waters to see how vulnerable American infrastructure is.
“The attacks that have been implemented are not sophisticated. It does seem that they are looking to see what’s in the realm of possibility. So, it is perhaps a testing exercise,” Huff told KATV.
It’s a reminder that utilities need to harden their digital defenses as foreign adversaries increasingly target U.S. critical infrastructure, pre-positioning themselves for future sabotage on a grander scale.
“We know they’re out there and that they’re coming and that they could come anytime at a faster or a broader scale than what we’ve seen previously. It’s important that water utilities take heed of what’s happening right now and say, okay, it’s time for us to make the investment. It’s time for us to retrain. It’s time for us to connect with other partners, do whatever is necessary to work together to ensure that these threats don’t become something bigger down the road,” Shackelford said.
Because of the digital threat, the FBI is also telling water utilities to be able to switch to all-manual operations, something Central Arkansas Water said it can do if necessary.
