The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory to water and wastewater utilities, emphasizing the immediate need to disconnect programmable logic controllers (PLCs) from public internet access. This directive comes in response to a surge in cyberattacks targeting these critical systems.
PLCs are essential components in managing industrial processes such as water treatment, pumping, chemical dosing, and wastewater management. When these devices are accessible online, they become vulnerable to malicious activities. Attackers have been known to alter configurations, disrupt operations, and lock out authorized personnel from essential equipment.
Recent incidents have demonstrated the severity of these threats. Cyber adversaries have targeted water utilities of varying sizes, including those with established cybersecurity measures. In some cases, attackers have changed PLC passwords, preventing operators from accessing the devices. They have also modified device IP addresses, effectively severing the connection between the PLCs and their managing organizations. Such actions have led to operational disruptions, including boil water advisories and the necessity for prolonged manual operation of water systems. While manual control can maintain service continuity, it places additional strain on staff and may compromise safety and reliability if disruptions are prolonged.
Hidden Vulnerabilities and Immediate Actions
CISA highlights that vulnerabilities may not always be apparent. Some operational technology assets are connected via cellular modems installed by equipment vendors, integrators, or operators. These connections might not appear in standard external attack-surface scans or asset inventories, leaving organizations unaware of their exposure. To mitigate these risks, CISA advises the following immediate actions:
- Disconnect PLCs from the Internet: Ensure that PLCs are not directly accessible from the public internet.
- Implement Secure Remote Access: Utilize properly secured virtual private networks (VPNs) or gateway devices that provide authentication, monitoring, and access control for any necessary remote connections.
- Enforce Strong Password Policies: Replace default credentials with unique, strong passwords for each device to enhance security.
- Restrict Remote Connectivity: Use IP allowlisting to permit access only from approved engineering laptops and other authorized operational technology systems.
- Maintain Verified Backups: Ensure the availability of clean backups of PLC images and configurations. This is crucial for restoring access and returning equipment to a known safe state in case of unauthorized changes.
For operators of Rockwell Automation MicroLogix 1400 PLCs, CISA recommends consulting the manufacturer’s guidance on restoring access when the controller password is unknown.
Broader Implications and Recommendations
This alert underscores the escalating threats to operational technology within the water sector. Internet-exposed devices are susceptible to a range of risks, including unauthorized configuration changes, service outages, and potential physical damage. Utilities are urged to thoroughly examine all external connections, including any undocumented vendor-installed cellular equipment, to ensure that no critical PLC is directly exposed to the public internet.
CISA advises following its operational technology mitigation guidance and suggests that the Environmental Protection Agency’s Cybersecurity Technical Assistance Program can offer additional support for the water sector. Organizations detecting malicious activity should report it to CISA, the FBI, or the Internet Crime Complaint Center.
In light of these developments, it is imperative for water utilities to reassess their cybersecurity postures. The increasing sophistication of cyber threats targeting critical infrastructure necessitates proactive measures to safeguard essential services. Disconnecting PLCs from public internet access is a fundamental step in mitigating these risks and ensuring the resilience of water and wastewater systems.
