Reconnaissance Is Not an Incident

Every statement out of the water sector this week says the same thing. Contained. Water is safe. Operators handled it. That is an after action report written by the wrong side.

Twelve states now. More than thirty Minnesota systems in one weekend, nine in Michigan, boil water notices, lost pressure, plants dropped into manual, operators locked out of their own controllers because somebody changed an IP address and a password. One utility found modified project files after spotting ladder logic discrepancies across sites. Officials called it a near miss. I call it a completed test.

A red team does not open on the Crown Jewels (I never go for the Full Monty on the first pass).You touch the small stuff nobody watches, then you sit back and time the response. How long before anyone notices. Who gets called. How fast they fail over to manual. Whether the fix is a fix or a password reset. Whether anybody verifies the logic after restoring. Whether the state and the feds talk to each other or past each other. You steal nothing on that pass. You are pricing the defense.

Thirty small utilities in a weekend is not vandalism, it is a survey, and we handed over the results for free and then held a press conference. We are always so proud of ourselves we give away the playbooks. 

Look at the run up. Israel 2020. Camrosa. A fired contractor’s live TeamViewer credentials in the Bay Area. Oldsmar. Two quiet Pennsylvania systems. Aliquippa, on a controller still sitting at default password 1111. Fewer than ten utilities in a 2023 CISA advisory. County Mayo, same box, same published password. Muleshoe overflowing while a resident happened to look up, plus Abernathy, Hale Center and Lockney through one shared remote access vendor. Veolia. Arkansas City. American Water. Then Iranian PLC exploitation documented since March, expanded to Schneider and Siemens, project files walking out the door. Six years, same three findings.

Nothing structural changed this week. Fifty thousand community water systems, eighty percent serving under 3,300 people, most run by one or two people who also do billing and compliance. Electric lives under binding federal standards with real penalties. Water has no equivalent. AWIA asks a utility to assess itself, and EPA found over seventy percent of inspected systems out of compliance with even that. EPA cannot mandate. CISA is smaller than last year. The volunteer program built to close the gap has reached twenty one of them.

Get the controllers off the public internet, put attributable MFA in front of them, inventory what you actually own, and assume the logic was touched. That is the floor, not the victory.

If someone probes your smallest site tonight, do you learn it from your monitoring, or from a resident watching a tower overflow?