{"id":2036973,"date":"2024-11-19T16:15:39","date_gmt":"2024-11-19T21:15:39","guid":{"rendered":"https:\/\/securityboulevard.com\/?p=2036973"},"modified":"2024-11-19T16:16:27","modified_gmt":"2024-11-19T21:16:27","slug":"epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems","status":"publish","type":"post","link":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/","title":{"rendered":"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems"},"content":{"rendered":"

More than 300 drinking water systems in the United States that serve almost 110 million people have security flaws \u2013 including a third of which have \u201ccritical\u201d or \u201chigh\u201d vulnerabilities \u2013 that if exploited by bad actors could disrupt service, physically damage the infrastructure, or lead to the theft of customer or proprietary information, according to the Environmental Protection Agency (EPA).<\/p>\n

In addition, the EPA\u2019s Office of the Inspector General (OIG) in a report this week criticized the agency<\/a> for lacking a system that water and wastewater system operators could use to notify the EPA of cybersecurity incidents and documented policies and procedures outlining coordination with CISA and other federal and state agencies that would be involved in a emergency response, security metrics, or mitigation strategies.<\/p>\n

Inspector Sean O\u2019Donnell and Ted Stanich, associate administrator for the Office of National Security, also noted a report by the Government Accountability Office recommending the EPA assess the cyber risks to the water and wastewater sector, create and implement a nation cybersecurity strategy, ensure it has the legal authority to carry out its responsibilities, and, if needed, ask for more authority.<\/p>\n

\u201cMy office is notifying you of these concerns so that the Agency may take whatever steps it deems appropriate,\u201d O\u2019Donnell and Stanich wrote.<\/p>\n

Water Systems Under Siege<\/h3>\n

The OIG\u2019s report comes after a year that saw municipal water systems come under attack by threat groups, some of which were connected to adversary nation-states like Iran.<\/p>\n

The Municipal Water Authority in Aliquippa, Pennsylvania, last year was attacked by a hacking group called CyberAv3ngers<\/a>, which is linked to Iran\u2019s government and that has a history of targeting critical infrastructure like water, energy, and transportation operations. The hackers exploit several flaws in programmable logic controllers developed by Unitronics to take control of a systems used to monitor the water pressure of nearby towns.<\/p>\n

The same group was suspected by the federal government of attacks on other water systems<\/a> in the United States that were using Israeli-made equipment like Unitronics devices.<\/p>\n

More recently, the municipal water system of Arkansas City, Kansas, was hit with a cyberattack<\/a> at its water treatment facility, with officials saying the drinking water was safe and there was no disruption to services.<\/p>\n

It\u2019s why the OIG\u2019s findings regarding security vulnerabilities are important.<\/p>\n

\u201cDrinking water systems are critical infrastructure,\u201d O\u2019Donnell and Stanich wrote. \u201cAs such, identifying and addressing cybersecurity concerns within these systems and reporting and coordinating responses to potential cybersecurity incidents is critical to preventing related disruption, corruption, and dysfunction, and to protecting public health.\u201d<\/p>\n

A Broad, Passive Assessment<\/h3>\n

The report outlined the results of a passive assessment of vulnerabilities that was run on drinking water systems that served 50,000 or more people. The OIG used a \u201cmultilayered, passive assessment tool to scan the public-facing networks of 1,062 drinking water systems across the United States.\u201d The program looked at five areas of concern: email security, IT hygiene, vulnerabilities, adversarial threats, and malicious activity.<\/p>\n

Of the 1,062 systems assessed, 97 \u2013 serving about 26.6 million people \u2013 had either critical- or high-risk security flaws, the report found. Another 211 systems, serving more than 82.7 million people, were given medium- and low-risk scores for having externally visible portals.<\/p>\n

The investigators mapped the digital footprint of each of the assessed drinking water systems, which comprise myriad facilities or components found through a geographic area, including buildings and infrastructure used to collect, pump, treat, store, and distribute drinking water.<\/p>\n

More than 75,000 IPs and 14,400 domains were analyzed.<\/p>\n

Critical Infrastructure at Risk<\/h3>\n

Water and wastewater systems were among 16 critical infrastructure systems identified by the Biden Administration needing cybersecurity protections. In January, the EPA, FBI, and CISA issued a cybersecurity guide<\/a> for water system operators, which came weeks after U.S. Department of Homeland Security in a report directed CISA to coordinate with other agencies and water system operators to improve the sector\u2019s cyber resilience.<\/p>\n

The EPA in early 2023 ordered states to assess the security of their public water systems but rescinded the order<\/a> later in the year after states and water works groups sued I federal court, claiming the agency was overstepping its authority.<\/p>\n","protected":false},"excerpt":{"rendered":"

The watchdog for the EPA found that, of 1,062 U.S. drinking water systems it assessed, 97 had “critical” or “high-risk” security flaws and another 211 had less dangerous vulnerabilities, risking threats from stolen data to disrupted service.<\/p>\n","protected":false},"author":20461,"featured_media":1871981,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[23406,98344,13571,782,21858,20984,30691,518,14089,14098,30205,14097,98631,99462,99461,13418,497],"tags":[86403,98897,98898,14081],"class_list":["post-2036973","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","category-data-privacy","category-data-security","category-endpoint","category-sb-featured","category-incident-response","category-sb-industry-spotlight","category-mobile-security","category-network-security","category-sb-news","category-security-awareness","category-sb","category-social-facebook","category-social-linkedin","category-social-x","category-sb-spotlight","category-vulnerabilities","tag-cyber-attack-on-critical-infrastructure","tag-epa","tag-public-water-systems","tag-vulnerabilities"],"acf":[],"yoast_head":"\nEPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems - Security Boulevard<\/title>\n<meta name=\"description\" content=\"An assessment of 1,062 U.S. drinking water systems found "critical" or "high risk" vulnerabilities in systems serving 110 million people.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems\" \/>\n<meta property=\"og:description\" content=\"The watchdog for the EPA found that, of 1,062 U.S. drinking water systems it assessed, 97 had "critical" or "high-risk" security flaws and another 211 had less dangerous vulnerabilities, risking threats from stolen data to disrupted service.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/\" \/>\n<meta property=\"og:site_name\" content=\"Security Boulevard\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/groups\/24445075146\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-19T21:15:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-19T21:16:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1540\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jeffrey Burt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@securityblvd\" \/>\n<meta name=\"twitter:site\" content=\"@securityblvd\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/\",\"url\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/\",\"name\":\"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems - Security Boulevard\",\"isPartOf\":{\"@id\":\"https:\/\/securityboulevard.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg\",\"datePublished\":\"2024-11-19T21:15:39+00:00\",\"dateModified\":\"2024-11-19T21:16:27+00:00\",\"author\":{\"@id\":\"https:\/\/securityboulevard.com\/#\/schema\/person\/f38bb7663c788778985274cf1b68758a\"},\"description\":\"An assessment of 1,062 U.S. drinking water systems found \\\"critical\\\" or \\\"high risk\\\" vulnerabilities in systems serving 110 million people.\",\"breadcrumb\":{\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage\",\"url\":\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg\",\"contentUrl\":\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg\",\"width\":1540,\"height\":600,\"caption\":\"water system cyberthreats EPA OIG\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/securityboulevard.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity\",\"item\":\"https:\/\/securityboulevard.com\/category\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Threats & Breaches\",\"item\":\"https:\/\/securityboulevard.com\/category\/blogs\/threats-breaches\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Vulnerabilities\",\"item\":\"https:\/\/securityboulevard.com\/category\/blogs\/threats-breaches\/vulnerabilities\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/securityboulevard.com\/#website\",\"url\":\"https:\/\/securityboulevard.com\/\",\"name\":\"Security Boulevard\",\"description\":\"The Home of the Security Bloggers Network\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/securityboulevard.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/securityboulevard.com\/#\/schema\/person\/f38bb7663c788778985274cf1b68758a\",\"name\":\"Jeffrey Burt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/securityboulevard.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2023\/07\/cropped-Jeffrey-Burt-photo-96x96.jpg\",\"contentUrl\":\"https:\/\/securityboulevard.com\/wp-content\/uploads\/2023\/07\/cropped-Jeffrey-Burt-photo-96x96.jpg\",\"caption\":\"Jeffrey Burt\"},\"description\":\"Jeffrey Burt has been a journalist for more than three decades, writing about technology since 2000. He\u2019s written for a variety of outlets, including eWEEK, The Next Platform, The Register, The New Stack, eSecurity Planet, and Channel Insider.\",\"url\":\"https:\/\/securityboulevard.com\/author\/jeffrey-burt\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems - Security Boulevard","description":"An assessment of 1,062 U.S. drinking water systems found \"critical\" or \"high risk\" vulnerabilities in systems serving 110 million people.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/","og_locale":"en_US","og_type":"article","og_title":"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems","og_description":"The watchdog for the EPA found that, of 1,062 U.S. drinking water systems it assessed, 97 had \"critical\" or \"high-risk\" security flaws and another 211 had less dangerous vulnerabilities, risking threats from stolen data to disrupted service.","og_url":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/","og_site_name":"Security Boulevard","article_publisher":"https:\/\/www.facebook.com\/groups\/24445075146\/","article_published_time":"2024-11-19T21:15:39+00:00","article_modified_time":"2024-11-19T21:16:27+00:00","og_image":[{"width":1540,"height":600,"url":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg","type":"image\/jpeg"}],"author":"Jeffrey Burt","twitter_card":"summary_large_image","twitter_creator":"@securityblvd","twitter_site":"@securityblvd","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/","url":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/","name":"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems - Security Boulevard","isPartOf":{"@id":"https:\/\/securityboulevard.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage"},"image":{"@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg","datePublished":"2024-11-19T21:15:39+00:00","dateModified":"2024-11-19T21:16:27+00:00","author":{"@id":"https:\/\/securityboulevard.com\/#\/schema\/person\/f38bb7663c788778985274cf1b68758a"},"description":"An assessment of 1,062 U.S. drinking water systems found \"critical\" or \"high risk\" vulnerabilities in systems serving 110 million people.","breadcrumb":{"@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#primaryimage","url":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg","contentUrl":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg","width":1540,"height":600,"caption":"water system cyberthreats EPA OIG"},{"@type":"BreadcrumbList","@id":"https:\/\/securityboulevard.com\/2024\/11\/epa-ig-office-high-risk-security-flaws-in-hundreds-of-water-systems\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/securityboulevard.com\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity","item":"https:\/\/securityboulevard.com\/category\/blogs\/"},{"@type":"ListItem","position":3,"name":"Threats & Breaches","item":"https:\/\/securityboulevard.com\/category\/blogs\/threats-breaches\/"},{"@type":"ListItem","position":4,"name":"Vulnerabilities","item":"https:\/\/securityboulevard.com\/category\/blogs\/threats-breaches\/vulnerabilities\/"},{"@type":"ListItem","position":5,"name":"EPA IG Office: \u2018High-Risk\u2019 Security Flaws in Hundreds of Water Systems"}]},{"@type":"WebSite","@id":"https:\/\/securityboulevard.com\/#website","url":"https:\/\/securityboulevard.com\/","name":"Security Boulevard","description":"The Home of the Security Bloggers Network","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/securityboulevard.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/securityboulevard.com\/#\/schema\/person\/f38bb7663c788778985274cf1b68758a","name":"Jeffrey Burt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securityboulevard.com\/#\/schema\/person\/image\/","url":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2023\/07\/cropped-Jeffrey-Burt-photo-96x96.jpg","contentUrl":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2023\/07\/cropped-Jeffrey-Burt-photo-96x96.jpg","caption":"Jeffrey Burt"},"description":"Jeffrey Burt has been a journalist for more than three decades, writing about technology since 2000. He\u2019s written for a variety of outlets, including eWEEK, The Next Platform, The Register, The New Stack, eSecurity Planet, and Channel Insider.","url":"https:\/\/securityboulevard.com\/author\/jeffrey-burt\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/securityboulevard.com\/wp-content\/uploads\/2021\/02\/oldsmar-greis-v-pixabay.jpg","jetpack_shortlink":"https:\/\/wp.me\/p91vu9-8xUp","_links":{"self":[{"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/posts\/2036973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/users\/20461"}],"replies":[{"embeddable":true,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/comments?post=2036973"}],"version-history":[{"count":2,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/posts\/2036973\/revisions"}],"predecessor-version":[{"id":2036977,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/posts\/2036973\/revisions\/2036977"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/media\/1871981"}],"wp:attachment":[{"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/media?parent=2036973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/categories?post=2036973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securityboulevard.com\/wp-json\/wp\/v2\/tags?post=2036973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}