The U.S. says the digital security of the computer network that controls the machines that produce and distribute water and electricity in the U.S. is seriously inadequate. Operators and regulators should take great care in securing these systems, which pose a dire threat to national security.
Back in 2018, the Los Angeles Department of Water and Power was hacked in just six hours. Earlier this year, an intruder lurked in hundreds of computers connected to water systems across the United States. In Portland, Oregon, malicious actors installed malware on computers in the power grid that powers a large swath of the Northwest United States.
On February 5, 2021, a hacker obtains a computer that controls chemical content at a water treatment plant in Aldesma, Florida. Then, they tried to adjust the sodium hydroxide levels in the plant. A small amount of sodium hydroxide helps to safely sanitize water. But in larger numbers, it can be fatal.
According to Sheriff Bob Gualtieri, the hackers managed to raise the sodium hydroxide level from 100 parts per million (ppm) to 11,100 ppm. Fortunately, an operator witnessed the breach in progress and restored the chemical levels to the proper settings. The water was then tested to verify its safety.
“If a new world war is to break out tomorrow, we have to worry about protecting our infrastructure from cyberattacks from Russia or country A,” said Andrea Carcano, co-founder of control systems security firm Nozomi Networks.
Technology systems in critical infrastructure are too old for cybersecurity tools
Over the past few months, hackers working for profit have targeted companies that operate networks such as pipeline fuel systems. They infected the pipeline’s information technology systems with ransomware, forcing the pipeline owners to stop the flow of 2.5 million barrels a day of oil products.
Many technical systems in critical infrastructure are too old for sophisticated cybersecurity tools. Network administrators are concerned that the push to digitize critical infrastructure could increase the network’s exposure to hackers, Carcano said.
Digitization enables industrial companies and utilities to increase efficiency and increase oversight and control over their vast operations, which in the case of the pipeline, stretches 5,500 miles through its branch from Texas to New Jersey. However, vulnerabilities in its office IT systems could provide an entry point for hackers to break into control systems later.
Capgemini North America Network Solutions Designer Chris? Chris Willims said: “I think what has happened in the near term is the most likely scenario in front of us.
Standards for U.S. pipeline infrastructure are set by the Transportation Security Administration (TSA), the government agency responsible for airport security that has traditionally been understaffed and underfunded.
Until last year, the TSA had only six full-time staff members dealing with pipeline safety issues. That number has since increased to 34.
According to Federal Energy Regulatory Commission (FERC) Commissioner Neil Chatterjee, this responsibility should be stripped from the TSA and transferred to the Department of Energy (DOE). “I’m concerned about the economic and national security implications of this attack, and we’re seeing in real time what’s happening in the United States,” he said.
The company has partnered with the FBI and Secret Service to launch a criminal investigation.
President Joe Biden has taken steps to strengthen cybersecurity. On May 12, 2021, Biden signed an executive order aimed at strengthening U.S. cybersecurity defenses.
The president’s executive order calls for the federal government and the private sector to work together to address the “continued and increasingly sophisticated malicious cyber activity” that threatens national security.
Energy Secretary Jennifer Granholm said last month, “In the face of the changing set of risks of the 21st century, we must rethink our approach to security and reassess what we can do in such emergencies. accepting authorities.
US government needs to be proactive in fighting cybercriminals
Governments tend to be reactive when cyberattacks do not cause actual damage. Take ONE Gas in Tulsa, Oklahoma, where Niyo Pearson oversees cybersecurity in January 2020 when his team was alerted to malware trying to enter its operating system, which controlled natural gas flows in Oklahoma, Kansas and Texas.
For two days, his team has been waging war against hackers moving laterally through the network. Ultimately, Pearson’s team managed to drive out the invaders.
When Cynalytica’s Richard Robinson entered the corrupted file into its own identification program, ONE Gas learned it was dealing with malware capable of executing ransomware.
Pearson tried to bring the data to the FBI, but his system couldn’t burn the data to a CD. When he notified the Department of Homeland Security (DHS) and sent it through a secure portal, he never heard back from DHS.
Robinson briefed the U.S. Department of Homeland Security, the Defense Department, the Defense Department and the intelligence community on a conference call. He didn’t hear back either.
The Links: LQ121S1LG42 DMF-50174ZNF-FW
