By Gregory Hale
Water utilities have been facing the broken end of a bottle for decades and while the industry is aware of the issue and some organizations are offering aid, as multiple states will attest after the latest rounds of attacks, this critical infrastructure sector needs help.
To that end, threat intelligence provider, Cyware, inked a partnership pact with WaterISAC, which serves as the communications and information-sharing organization for the water sector, to provide water and wastewater utilities with real-time, AI-powered threat intelligence, enabling streamlined information sharing.
“We will enable a subset of (Water ISAC) members to be able to share and take automated actions on threats to water utilities,” said Tom Stockmeyer, managing director, government and critical infrastructure at Cyware. “And this will be the water utilities to start that have the most resources and what we call the ability to connect machine to machine. for bidirectional sharing and automated actioning on their end.”
“It’s about helping the community better protect water utilities from cyber threats. What we know from our industry expertise is the malicious actors, whether they’re nation-state or individual, find a way in through a vulnerability or some other tactic or technique, and then they, as fast as they can, try and replicate that across industry or across the sector,” Stockmeyer said.
Speed of Threat Intelligence
In the end, one utility may end up hit, but it is possible to mitigate risk across the whole sector by sending out effective threat intelligence. The speed to which you can get that information out to other utilities is critical.
“We have expertise through other ISACs that we work with that we’ve helped them,” Stockmeyer said. “One very large sector, they would say the average time it would take them is six to eight hours to develop a threat intelligence package they could then share with their members and get that out to the other members from something reported in from one member. And they would say after implementing Cyware their average time to do that now is one minute. One minute with same or better quality of intelligence.”
“If you can get the information out faster, that limits the success, and you can get the water utilities who are getting that information to put a red hot, this is a threat active. These are the tactics and techniques they’re using. This time it’s a PLC. If you have this make and model, here’s the patch you need to apply like right away,” he said.
You can get that information out pronto; it limits the success the threat actor’s going to have from maneuvering laterally across the sector.
Cross-Sector Sharing
Additionally, there is also the possibility of cross-sector sharing.
Sectors will now be able, with an automated rules engine, be able to share with their cousin sectors that also rely heavily on industrial control sectors like the gas and electric utility industries.
As an example, Stockmeyer gave the PLC.
“The PLC may be a little bit different in water, but it’s probably made by the same manufacturer, with the same chipsets for a water utility or a gas turbine.
The partnership raises awareness after an attack occurs, but how can this help in terms of warding off attacks to begin with?
“CISA (Cybersecurity and Infrastructure Security Agency) does an excellent job of kind of monitoring what threat actors are doing across the sector,” said Tom Dobbins, executive director of WaterISAC. “We’ll get alerts ahead of time from CISA that we can then use Cyware to help us get that distribution out faster. So, it’s analyzing the intelligence. And the other thing is we’re talking about 50,000 plus water utilities of all levels of size and sophistication. And so, not only do we want to speed machine to machine, but also to enable our analysts to get that information as quickly as possible and to be able to get information out to those smaller utilities.”
“One of the challenges the water sector has in particular is historically limited resources on the cyber side,” Stockmeyer said. “Certainly, there are some water utilities that have a lot of resources, but many just don’t. Addressing that holistically is a bigger question. I think at some point the federal government will step in.”
Hitting Easy Mark
“When you’re getting to those mid and smaller utilities, and if you go through and look at the towns that were attacked in Minnesota or in the other six states, you’ll see it’s not Atlanta, it’s not Boston, it’s not Chicago,” Dobbins said. “It’s small to mid-sized cities who are 200 miles from the interstate and don’t understand why anybody would be interested in them. On the cyber landscape, it doesn’t matter how big you are. It’s just, are you a viable target? Are you an easy target? And so, the easiest targets are the smallest targets because their whole reason for attackers doing this is to get press and to inflict some kind of pain or to show they can reach in and the federal government can’t protect the citizens from these hacktivist groups.”
“What we want to do is through groups like WaterISAC and National Rural Water Association and others, try to get the resources to those smaller utilities,” Stockmeyer said. “And because their systems aren’t as sophisticated, they still need help doing basic things like cyber hygiene they may not be doing just because they’re small and they don’t have the resources.”
Make the Case for Security
As the technology gets more sophisticated, utilities have less resource capacity to actually manage and operate the technology, Stockmeyer said.
“The water sector is a victim of its own success in the sense that we’ve made water ubiquitous, we’ve made it safe, and it’s something that we all take for granted,” Dobbins said. “And so, we just, we turn on the faucet and it’s there. And yeah, obviously we’ve had some incidences that have taken place, but that’s somewhere else and it’s an aberration. The water sector’s not been as effective as other sectors of the economy in making the case for better security and more resources to do that.”
Click here for more information.