States warned of ‘recent and ongoing’ cyber threats to critical infrastructure

A letter last week from two senior Biden administration officials warned states of “disabling cyberattacks” that could “disrupt the critical lifeline of clean and safe drinking water, as well as impose significant costs on affected communities.”

Just months after two separate attacks on water systems in Pennsylvania and Texas, Michael Regan, administrator of the Environmental Protection Agency, and Jake Sullivan, national security advisor, wrote governors warning of “two recent and ongoing” threats associated with China and Iran, and calling for their “partnership” in combating the issue.

“Drinking water and wastewater systems are an attractive target for cyberattacks,” the two officials wrote, “because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices.”

Governors are urged in the letter to take advantage of the various federal resources available to them through the EPA and the Cybersecurity and Infrastructure Security Agency, as well as private sector associations. It said state leadership connecting water systems to these tools and resources “is essential to ensure that utility leaders assess and mitigate critical cyber risks.”

The letter more generally highlights the continued tension that surrounds critical infrastructure: It is the responsibility of state and local governments to ensure that they are protected, but officials frequently note that they lack the resources to fund that protection. It’s led to discussions at the federal level about who should be responsible for critical infrastructure’s cybersecurity: federal agencies or lower levels of government.

Administration officials have indicated a willingness to play a bigger role in protecting critical infrastructure. Drenan Dudley, deputy national cyber director for strategy and budget at the Office of the National Cyber Director, said during the Billington State and Local Cybersecurity Summit in Washington, D.C., that officials are keen to “shift the burden” away from jurisdictions that have more limited budgets.

“We want to make sure that we’re trying to take that unfair responsibility off of entities least able to bear it and push it up a bit,” Dudley said.

Indeed, it is typically the smallest communities first in the firing line because they lack dedicated cyber staff and the money to upgrade systems.

“Cybercriminals fight dirty, and they target smaller municipalities that have a large impact on society with the hopes their recovery and response capabilities are lacking,” Michael Bimonte, chief technology officer for state, local and education at cyber company Armis, said in an email.

The effects of a successful cyberattack can be catastrophic regardless of a municipality’s size. The Colonial Pipeline hack in 2021 illustrates the damage such threats to infrastructure can cause. The breach to the gas pipeline system led to fuel shortages across the East Coast and disruptions to airline operations. Cyberattacks that same year tried unsuccessfully to poison water treatment plants in the Bay Area and in Oldsmar, Florida.

“Clean water is a particularly emotive target because it is a basic necessity for the well-being of the smallest towns to the largest countries,” Edward Parsons, director of global markets at the nonprofit International Information System Security Certification Consortium, said in an email.

In addition to highlighting the resources available to states, the letter from the EPA and White House also links to a list of actions “water and wastewater systems can take to reduce risk and improve protections against malicious cyber activity.”

State and local officials are already taking many of those actions and more. Texas Chief Information Security Officer Nancy Rainosek, for instance, said during a panel discussion at the Billington summit that the state has incident response teams that use the same tools as hackers to try and break into systems. With that strategy, she said, leaders are “trying to find in advance and close those gaps before somebody else makes the attack.”

Similarly, California CISO Vitaliy Panych said the state now has a critical infrastructure lab donated by private companies in which the state can bring in assessment teams and investigators to simulate attacks and how to defend against them.

Maryland’s water and wastewater systems are required by law to have a cybersecurity plan if they serve 10,000 or more users, while the state also requires incidents to be reported. Being proactive helps the state “stay ahead of the game,” said Netta Squires, the state’s director of local cybersecurity.

Pitfalls lie ahead, however. Helen Patton, a cybersecurity executive advisor at Cisco, warned that if a major event happened across a critical infrastructure sector, state leaders will be “on the hot seat” to provide some sort of centralized response, as currently there is little guidance on who would be in charge of that response, especially if it affected multiple jurisdictions at once.

This lack of guidance is one issue that could be brought up with the EPA’s Regan and White House’s Sullivan. In their letter, they invite state and local officials to engage with them on the efforts outlined in the text and on “others we may take together.”