Albany, NY (WRGB) — As seven states and more than 30 water systems nationwide recover from a water system cyber attack, New York State announced more funding for its own water systems on Monday.
The FBI and EPA issuing a Public Service Announcement last week, warning municipalities and critical infrastructure owners of targeted cyber attacks against Water and Wastewater Sector utility companies.
“After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices,” the release stated.
Investigators are still determining the source, with some speculating Iran could be behind the attacks, which President Trump has questioned.
Meanwhile, New York, which originally announced cybersecurity grants and regulations for water systems in March, unlocked more funding on Monday, saying $9 million will be awarded to 153 local water projects.
“Governor Hochul has been very proactive on this, so this is actually something that we had laid out in our 2023 cyber strategy for the State,” New York State Acting Chief Cyber Officer Michaela Lee told CBS6. “It is timely that we know there are incidents happening in other places where it’s necessary to identify where there are gaps in our cybersecurity posture and address those. But the main impetus for making these notifications is so that New Yorkers know that there’s a lot of work going on behind the scenes to make sure that their water is safe and secure.”
WCWN
Following the cyber attacks, New York Section Executive Director of the American Water Works Association Jenny Ingrao issued this statement:
“Cybersecurity for New York’s drinking water systems mirrors the situation throughout the US: Many systems, especially some of our largest utilities, have competent IT and cybersecurity teams and have the systems and protocols in place to thwart and prevent attacks. Others- especially our smaller systems maybe more vulnerable because they do not always have the staff and financial resources to put the proper protocols in place. The key is that one size does not fit all when it comes to cyber security, and we need to look at our systems individually, assess vulnerabilities, and put in cyber and operational safeguards to protect all New Yorkers.”
As for the funding, New York Section Chair Ken Naugle tells CBS6 it’ll be a boost for those smaller systems.
“Hopefully that will help the systems with the biggest needs to be able to get their programs off the ground, to get them the resources to at least begin to plug the gaps that exist with having proper cybersecurity hygiene and practices in place,” Naugle says. “It will be a continuous expectation that they need to have those programs operating 24 hours a day, seven days a week, and be able to respond going forward. But for those utilities that haven’t had a point to be able to start with some sort of program, these resources, this program, these funds will go a long way to helping to bridge that divide that exists.”
WCWN
The funding is part of the State’s “SECURE” or Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements, program.
