As cyber attacks continue suppressing critical infrastructure sectors like water and wastewater systems, implementing proper cybersecurity practices is becoming more vital in protecting against highly disruptive cybersecurity incidents. According to the Environmental Protection Agency (EPA), these threats on process control systems have the capacity to upset treatment/conveyance processes, steal customer personal data and credit card information from the billing system, and install ransomware to disable all control systems. Compromised water and wastewater facilities then face faltering levels of customer confidence along with financial and legal liabilities. In response, the EPA has taken steps to implement new cybersecurity rules for water sector agencies.
The EPA’s New Cybersecurity Policy
The Environmental Protection Agency recently announced that the sanitary survey reviews conducted at water facilities will be extended to include cybersecurity. Anne Neuberger, the deputy national security adviser for cyber and emerging tech, made the announcement, stressing the efficacy of public-private partnerships and the current missing elements in U.S. critical infrastructure. She states that the Australian legislation for cybersecurity follows a model that should be emulated by the U.S. The framework of the Australian Security of Infrastructure Act implements a cybersecurity standard to improve the transparency and operational control of Australian infrastructure, facilitates collaboration between government, regulators, and operators of infrastructure, and provides a means to respond to cybersecurity threats.
Anne stresses the importance of protecting critical infrastructure, stating that “When we drive a car, the car comes with the seatbelt, comes with airbags. It comes with standards for what’s the speed you can drive on the road. And what happens if there’s a major accident? We need the same with cyber.”
What the EPA Recommends
The Environmental Protection Agency also currently recommends implementing a cybersecurity program to remove any possible vulnerabilities that these attacks could exploit. You can check out the EPA’s cybersecurity resources page for the water sector on their website. Some precautions they recommend include ensuring that all IT systems have up-to-date security patches, separating network and control access based on job functions, and developing a contingency recovery plan for any critical systems.
Alvaka also recommends applying key mitigations to increase your cyber resilience in the following blog, Reduce the Risk of Ransomware & Other Cyber Attacks.
Click HERE to more about our Ransomware Prevention and Recovery Services! We are available 24×7 to assist you with any of your ransomware needs.
Latest Ransomware Related Blogs
Smoke testing is a term used to describe the testing process for servers after patches are applied. 
Estimating an average time for patching servers and PCs can be a bit tricky. It can vary from one month to the next, depending upon the number and complexity of the patches released by your software vendors. You must consider all versions of operating systems and have a complete inventory of all your application software to do this job correctly. Our experience has shown that manual patching of systems takes on average of about 1.5 hours each.
This is a basic cost calculator for you to compute your typical monthly cost for patching your servers, PCs, laptops, tablets and associated application software. It also forms the basis for you to begin calculating your Return on Investment for software patching, or for comparison with alternatives to the manual process of patching operating systems and application software—such as Patch Management as a Service, also known as Vulnerability Management as a Service.