Tennessee Tech Cybersecurity experts said cyber warfare targeting critical water infrastructure has moved from science fiction to a present reality.
Matthew Billings said this week’s attacks on some 30 water plants in Minnesota resulted in administrative systems being locked and service being shut off to customers. Billings said these incidents represent a form of asymmetric warfare where nation-states use computer systems to create physical effects and psychological impacts within the United States.
“We very much need to take the cybersecurity implications associated with those devices very seriously,” Billings said. “Our world is only going to get more technologically connected. It is only going to get more automated.”
Billings said small communities in the Upper Cumberland are often viewed as attractive targets by hackers because they are considered low-hanging fruit. Billings said local utilities may feel isolated or protected by their size, but they often lack dedicated cybersecurity personnel or regular vulnerability assessments.
“That lackadaisical attitude is oftentimes why the hack occurs,” Billings said. “And it it is so difficult to point fingers in this situation and so I I kind of want to talk about it from two perspectives. Number one, from the vendors. So as as we have this, if you’ve ever driven by one of these plants, especially like a water purification plant or a sewage plant that’s trying to refine the water, there are a lot of mechanisms, a lot of moving parts.”
Billings said modern water facilities are heavily mechanized operations controlled by computer interfaces rather than manual labor. Billings said a significant vulnerability exists because vendors often assume systems will be air-gapped, or kept off the internet, while local municipalities may connect them for convenience or budget reasons.
“I was talking to a vendor of devices like this last year and I was talking to them within the context of cyber and ‘hey, do you employ any cybersecurity personnel?’” Billings said. “And they go, ‘well, we don’t have to because we’ve never been hacked and we never will.’ And it was, so I started talking to them and ‘well, that’s a very bold statement that you would have the only secure systems ever in the world.’ And they go, ‘well, our systems are supposed to be air-gapped.’ And I was ‘are you training the people that you’re selling these to on that or are they aware of it?’ And he goes, ‘well, no, that’s not actually our responsibility, it’s on the people that we sell it to.’”
Billings said a successful attack in the Upper Cumberland could result in total service disruptions or the toxic contamination of the water supply with chemicals like lye or chlorine. Billings said while these chemicals often have distinct odors that would alert residents, the primary impact would be rendering the water unusable for a significant period.
“We are working here in the upper Cumberland on ESF 17, which is a cybersecurity response framework to be able to deal with that and there is a draft of it that’s out there,” Billings said. “And so it it all sounds kind of terrible, but this isn’t necessarily something that the upper Cumberland hasn’t considered, hasn’t looked at, and is incapable of responding to.”
Billings said Tennessee Tech is actively involved in local protection efforts by advising emergency management agencies and developing training kits for law enforcement. Billings said utilities can improve their security by taking critical systems offline, using virtual private networks, and hiring third-party companies to perform mock hacks to expose vulnerabilities.
Billings said operators should watch for blatant warning signs like a computer mouse moving on its own, which indicates a remote access tool is in use. Billings said because sophisticated attackers can hide their presence on computer screens, utility workers must continue to perform physical inspections of automated systems to verify they are operating correctly.
Billings is Assistant Director of Operations, Cybersecurity Education, Research and Outreach Center (CEROC) at Tennessee Tech.
