09/10/2024 | News release | Distributed by Public on 09/10/2024 06:17
September 10, 2024
According to Forescout Research and Vedere Labs, cybersecurity attacks on infrastructure rose by a staggering 30% in 2023, reaching a total of 420 million. This translates to 13 attacks per second on a wide range of targets, including drinking water systems, libraries, hospitals, transportation and manufacturing.
For hackers, water facilities present a tempting mix of vulnerable, high-impact targets. Common threats include ransomware, sleeper agents, physical cyberattacks and insider threats. The EPA reports that more than 70% of inspected water systems do not fully comply with security requirements in the Safe Drinking Water Act, a federal law used to manage water plants' safety and security practices.
Cybersecurity is crucial for water utilities as they increasingly rely on digital systems to maintain operations. These systems face significant threats that can disrupt water safety and provision. Major cybersecurity concerns include vulnerabilities in legacy systems, inadequate network segmentation and risks associated with remote access. Addressing these threats is vital to protect critical water services from cyberattacks, emphasizing the need for comprehensive water cybersecurity strategies.
Most OT systems are on a 10-20-year (or longer) technology refresh cycle. Utilities face constraints when updating these systems; they are expensive and sometimes require extensive downtime. As a result, these older components make the systems more difficult to secure.
Another threat to water utilities is the lack of segmented networks. Most OT networks are considered flat networks, a type of network architecture in which all devices are connected to a single network segment without any hierarchical segmentation or separation.
Flat networks are used primarily for simplicity and performance, but it is easier for hackers to move within the network. Once a hacker gains access, they can easily manipulate the network and are hard to detect.
Traditionally, OT networks have used software solutions for remote access that can be easily compromised. These methods were originally designed for convenience and accessibility, allowing operators, engineers, and technicians to connect to OT systems from remote locations to perform maintenance, troubleshooting or system updates. However, these networks come with several inherent security risks, especially in the context of modern water cybersecurity threats.
Historically, the solution was to implement hardware firewalls, Virtual Local Area Networks (VLANs), Virtual Private Networks (VPNs) and complex policies. These water security solutions work, but they are expensive and require complex configuration and significant downtime to implement.
There is a better way.
A Zero-Trust Overlay Network is a clear solution to effectively address the threats above. This type of network runs parallel with the existing network, allowing processes to perform uninterrupted. In simpler terms, this approach adds an extra layer of security to your existing network. This solution allows for network cloaking, micro-segmentation and secure dual-factor authentication remote access. The Zero-Trust Network Architecture (ZTNA) simply means that nothing within the network is trusted.
ZTNA requires that each device or user be continuously verified. This is done through biometrics (fingerprint or face scan) and unique, one-time-use QR codes. Users requesting access can be assigned individual permissions to see only what they need to accomplish their assigned duties.
The overlay network can hide specific network devices based on permissions assigned by an administrator. Since this happens in the overlay network, it does not affect the operational properties of these devices. This is especially useful when dealing with legacy equipment.
Micro-segmentation is also accomplished by utilizing permissions. Devices on the network cannot communicate with each other unless specific permission has been granted and proper authentication through ZTNA is established.
Once a Zero-Trust Overlay Network is in place, everything in the network can now have its own segment and is individually securable.
ZTNA is focused on increasing authentication and monitoring. It ensures that each user is authenticated, every access request is validated and all activities are continuously monitored. ZTNA can be an effective tool for utilities implementing smart, emerging technologies to limit risk within critical infrastructure environments. According to the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST), ZTNA is now becoming the gold standard for cyber resilience.
While the Zero-Trust Overlay Network is a huge step in protecting against cybersecurity threats, there are other concerns that utilities must consider. Insufficient cybersecurity training and awareness, third-party and supply chain risks and outdated or poor patch management are all additional risks. Inadequate monitoring and detection, inside threats like disgruntled employees and physical security also need to be navigated. The EPA is beginning to issue more regulations requiring states to include cybersecurity assessments in their sanitary surveys of public water systems.
Once we complete the condition assessment audit, our team will draft a roadmap toward achieving robust cybersecurity resilience. This will group and prioritize upgrades into a logical list of projects backed by sound reasoning to help justify needed budgets.