Asymmetrical Warfare
I have spent thirty years watching people build moats around castles with a screen door in the back.
This week the FBI confirmed that water and wastewater utilities in at least seven states reported cyber incidents, some of which degraded operations. More than thirty Minnesota community water systems were hit on July 26 and 27. CISA told operators, in plain language, to pull their programmable logic controllers off the public internet immediately. Not next quarter. Now. Investigators are looking hard at Iranian linked actors, though attribution is not settled and I am not going to pretend it is.
Here is the part nobody wants on a slide. The lock on the front door of American water is cheeseball. In 2023 a booster station in Aliquippa, Pennsylvania fell because a controller sat on the open internet with the factory password 1111. Four digits. The EPA has found that more than seventy percent of the water systems it inspected since 2023 fail basic requirements, including changing default passwords and cutting off former employees. Its own Inspector General scanned about a thousand large drinking water systems and found ninety seven, serving 26.6 million people, carrying critical or high risk vulnerabilities. Roughly one in five utilities nationally maintains even baseline hygiene. There are more than fifty thousand community water systems in this country and most have no security staff at all, because a town of four thousand cannot fund one.
That asymmetry is the entire story. A nation state spends almost nothing to reach a pump station a part time clerk manages between other duties. The attacker does not need a zero day. He/she needs a search engine and a default credential. Meanwhile we keep pouring money into enterprises that already have budget, hiring the same names out of the same shops, and leaving the least defended systems in the country responsible for the most consequential physical function we have.
I keep saying the technical side is not where we lose. We lose on attitude, on assumption, on nobody asking the boring question. Is that thing reachable from the internet. Who has the password. When did we last actually look. In Minnesota, operators lost monitoring and ran plants by hand at three in the morning. That was the good outcome.
If you sit on a municipal board, a water authority, a town finance committee, this is yours. Funding cyber for a utility is not IT overhead. It is public health.
Would your town even know if someone had already changed the password? With the proliferation of AI this is why all organizations big,small, private,public and government need to realize they are targets and to take Cyber Security seriously.
Reach out if you want to discuss.