The city of Albany, which operates two reservoirs, including the Alcove Reservoir, above, is using government grant money to strengthen its operations against cybersecurity breaches seen in other states.
Local water and sewer departments are shoring up their firewalls and virtual private networks following a series of cyberattacks on municipal water systems.
Gov. Kathy Hochul’s office is distributing more than $9 million in grants to 153 municipal water facilities to bolster cybersecurity. The news comes as at least seven states have reported cyberattacks on such utilities — with suspected ties to Iran — since July 27.
Article continues below this ad
Over a dozen water and sewer departments in the Capital Region received state grant money to boost cybersecurity, including the towns of East Greenbush and Guilderland and the cities of Hudson and Rensselaer. It stems from new cybersecurity standards enacted last year that took effect in March, in part requiring training and reporting any breaches. Much of what that grant funding looks like is training, making sure systems are securely connected to the internet, and offering support, explained Michaela Lee, acting chief cyber officer in the governor’s office.
“You don’t need all sorts of fancy tools to defend against adversaries. You just need to know the basics,” she said.
More: Test results show high copper corrosion rate at Niskayuna water plant, pump station
Cohoes works on fix for water disinfection system after violation
Article continues below this ad
Workers at the Rensselaer Water Department are using grant money to strengthen the department’s computer systems to stave off cyberattacks.
Safety can be as simple as changing the default password from the manufacturer and keeping devices off the open internet by using VPNs, William Simcoe, acting water commissioner for the city of Albany, said. The city received $120,160 in state grants for its drinking water system and $73,170 for its sewer system.
Albany uses three separate computer systems in its water and sewer departments. One is for business transactions such as online bill pay, and another is for security, including cameras or building access. The one most likely to be targeted encompasses equipment such as pumps, valves and chemical feeds, Simcoe said. Remote access could be cut off to pump stations and water tanks. Sewage could be backed up or directed into overflow lines to the river. Pumps could be turned on or off, valves could be opened or closed and the amount of chemicals used to treat the water, like chlorine, could be raised or lowered.
At the heart — or more aptly the brain — is the programmable logic controller, or PLC, a computer used to program equipment and send data to an interface.
Article continues below this ad
“If there is an adversary or threat actor,” Lee said. “Targeting those PLCs or other parts of operational technology are most likely.”
The federal Cybersecurity and Infrastructure Security Agency, a component of the Department of Homeland Security, has warned that hackers have modified PLC passwords, locked out operators and disconnected them by changing their internet protocol addresses.
The FBI has also warned that some internet-exposed models of Allen-Bradley PLCs have been targeted, with hackers causing water pressure loss and flooding. Sarah Ruane, spokeswoman for the FBI Albany field office, said in a statement that their office works “seamlessly to share relevant information, provide security briefings, and conduct outreach” on security measures for facilities as well as how they should report any breaches.
Simcoe said the city uses Allen-Bradley, describing them as “the GE, the Microsoft” of PLCs, but said they don’t keep them on an open network, using “several different layers of consultants” to set them up and update them regularly.
Article continues below this ad
It’s not just water and sewer systems. Lee pointed to a 2013 incident in Westchester County where a dam was hacked by an Iranian-backed group. The dam was unaffected, but hackers appeared to have read files containing user names and passwords. Hospitals are also being shored up against potential breaches, Lee said.
“There has been a lot of work in the past 13 years to ensure greater assurance and safeguards,” she said.
While such breaches aren’t a new concept, the latest concern is the use of AI to hack systems, which could allow hackers to work faster and at a larger scale.
One particular safeguard seen in states where hacking has taken place is the ability to switch to manual operations, Lee said.
Article continues below this ad
“It’s going to make people think more about how to operate manually if they have to,” he said.
