Cyber Security

Issue Summary
Water and Wastewater Sector Roles and Responsibilities
Federal Agency Roles
Resources
Funding

Issue Summary

The water and wastewater sector is part of the nation's critical infrastructure, defined in the USA PATRIOT Act as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." The supply of safe drinking water and treatment of wastewater are both considered National Critical Functions (NCFs).

Public water systems (PWS) and publicly owned treatment works (POTW) increasingly depend on cyber-physical systems (CPS), incorporating both information technology (IT) and operational technology (OT) into their operations. The COVID-19 pandemic further accelerated movement to remote operations.

These developments make the sector an attractive target for cybercriminals, particularly when a PWS or POTW depends on outdated operating systems, has insufficient controls or lacks a robust training program. Threat actors targeting water systems include nation-state political actors, cybercriminal financial actors and current and former employees. Their motivations range from stealing sensitive data and disabling network components to disrupting operations.

The consequences of cyberattacks can be dire, ranging from operational disruption and system component damage to the theft of customers' personal data. Most significant is compromising the ability of a PWS or POTW to provide clean, safe drinking water, protect the environment and maintain the confidence of the public.

Fortunately, there are many resources on best practices, preparation and response and funding that even the smallest utilities can leverage to effectively counter cybercriminals.

Back to Top

Water and Wastewater Sector Roles and Responsibilities

The America's Water Infrastructure Act of 2018 requires community water systems (CWS) serving more than 3,300 people to develop or update risk assessments and emergency response plans (ERPs), which must address "electronic, computer, or other automated systems (including the security of such systems)."

PWSs and POTWs are urged to reduce the risk of a successful cyberattack by implementing best practices, training staff, implementing a monitoring plan and updating technology. EPA and other federal and state agencies offer multiple cybersecurity capacity-building resources [link to Resources below] specifically for PWSs and POTWs. Drinking Water State Revolving Fund and Clean Water State Revolving Fund loans and set-asides may be used to build managerial, technical, and financial capabilities, conduct vulnerability assessments and trainings, develop effective cybersecurity measures and plans, upgrade IT and OT technology and more.

PWSs and POTWs can stay informed about potential threats impacting the water and wastewater sector, by:

• Monitoring the National Cyber Awareness System 
• Subscribing to the Cybersecurity & Infrastructure Security Agency's mailing list
• Taking advantage of WaterISAC's free membership

PWSs and POTWs should immediately report any cyber incident to the following entities:

• Local law enforcement and the primary oversight agency (typically the state)
• Local FBI field office or contact the Cyber Watch (CyWatch) at either the 24/7 support line at (855) 292-3937 or CyWatch@fbi.gov
• CISA Incident Reporting System
• WaterISAC online, at analyst@waterisac.org or 866-H2O-ISAC

Back to Top

Federal Agency Roles

Three federal agencies play key roles in supporting the cybersecurity of the water and wastewater sector:

• The Environmental Protection Agency (EPA) is the Sector Specific Agency (SSA) designated responsibility for supporting the security and resilience of the Water and Wastewater Systems Sector
• The Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security provides training and other tools and resources related to critical infrastructure security
• The Federal Bureau of Investigations (FBI) is the lead federal agency for investigating cybercrime

Additionally, the Office of the National Cyber Director is the White House's principal advisor on cybersecurity policy and strategy and the National Institute of Standards and Technology (NIST) develops standards, best practices and tools and public guidelines on cybersecurity measures.

CISA and EPA both offer numerous resources on preparing for and responding to cyberattacks [link to Resources below]

CISA, FBI and EPA collaborate in responding to significant cybersecurity incidents, from notification and assessment to making recommendations to avoid future attacks.

• CISA leads the response, collecting reports of cybersecurity and incidents and providing technical assistance to protect assets and reduce the impacts of attacks. The agency helps with restoring affected systems, coordinating federal assistance and improving security after the fact
• FBI handles the law enforcement and investigative activity
• EPA directs water and wastewater sector requests for assistance to CISA, confirms requests are fulfilled and communicates alerts. The agency coordinates cyber incident response among the appropriate federal agencies, facilitates the sharing of information and intelligence and maintains open lines of communication to affected utilities and other stakeholders

EPA and CISA collaborated with the National Security Council and the Water Sector Coordinating Council and Water Government Coordinating Council (WSCC/GCC) to develop the Water and Wastewater Sector Action Plan to promote early cyber-threat detection and information sharing across the federal government and critical infrastructure community. 

Back to Top

Resources

U.S. EPA

• EPA Cybersecurity Best Practices for the Water Sector. One-stop shop for accessing multiple resources, including a Cybersecurity Incident Action Checklist, Water Sector Cybersecurity Training and Response Exercises, the Vulnerability Self-Assessment Tool 2.0 (VSAT Web 2.0), Water Resilience Tabletop Exercise and more.
• Cybersecurity Technical Assistance for Water Utilities. Users can submit questions or a request for consultation regarding implementation of cybersecurity measures.
• EPA Water Laboratory Alliance offers resources on contamination preparedness, including workshops, assessment tools and scenario exercises. An overview is available here.
• EPA Baseline Information on Malevolent Acts for Community Water Systems. Compiled information on malevolent acts such as cyber-attacks and contamination that can put community water systems at risk.
• EPA's Water Sector Cybersecurity Evaluation Program. Submit requests for further information about EPA's Cybersecurity Evaluation Program, which  conducts cybersecurity assessments of water systems to identify gaps and potential vulnerabilities.

CISA

• State, Local, Tribal, and Territorial Government Program. Main landing page for CISA programs targeted to State, Local, Tribal and Territorial Governments featuring news articles, regional office contact information, and services.
• Services for State, Local, Tribal and Territorial Governments. List of services CISA offers for local governments, including descriptions, contact information, and relevant files.
• Assessment Evaluation and Standardization Program: Educational modules providing government-affiliated assessors the knowledge and skills to administer cybersecurity assessments using CISA standards and methodologies.
• Multi-State Information Sharing and Analysis Center (MS-ISAC). Resource for cyber threat prevention, protection, response and recovery for state, Tribal, local and territorial government entities. Includes 24/7 Security Operation Center, Incident Response Services, Advisories and Notifications, Cyber Alert Map, Joint Ransomware Guide, Cybersecurity Table-top Exercises and a variety of educational materials.
• Cyber Essentials Toolkit. A set of modules, each focusing on recommended actions to build cyber readiness, aimed at non-technical leadership.
• CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC). Resource for cyber threat prevention, protection, response and recovery for state, tribal, local and territorial government entities. Includes 24/7 Security Operation Center, Incident Response Services, Advisories and Notifications, Cyber Alert Map, Joint Ransomware Guide, Cybersecurity Table-top Exercises and a variety of educational materials.
• Stopransomware.gov. Resource center containing news, alerts, reporting mechanism and best practices for preventing or responding to ransomware.

Other Agencies and Organizations

• Cybersecurity Framework (National Institute of Standards and Technology). Published 2014; updated 2018. A flexible and performance-based voluntary framework of cybersecurity standards and procedures that sets out a risk-based approach to managing cybersecurity. 
• Cybersecurity Guidance and Tool. Supports the water sector in implementing the NIST Cybersecurity Framework.
• Water Sector Cybersecurity Risk Management Guidance. Provides a sector-specific approach for adopting the NIST Cybersecurity Framework in addition to aiding CWSs in complying with America's Water Infrastructure Act of 2018.
• Water Information Sharing and Analysis Center (WaterISAC). Offers physical and cyber threat alerts and best practices specifically for the water and wastewater sector, along with guidance such as 15 Cybersecurity Fundamentals for Water and Wastewater Utilities.
• Cybersecurity Assessment Tool and Guidance (AWWA). Includes step-by-step guide to identify cyber risks, set goals and effectively execute cybersecurity strategy. 
• Water and Wastewater Systems Cybersecurity 2021 State of the Sector. This report provides the results of a survey of utilities across the country to develop a picture of current cybersecurity practices in the sector to better articulate the challenges and needs of the sector. 

Funding

• LGEAN Finance page