The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Europol announces it has launched a new version of its “No More Ransom” website, where visitors can find 121 free tools to decrypt 151 ransomware families. Now in its fifth year, Europol notes the repository has helped more than six million people recover their files for free. Europol also says the revamped website has been modernized and made to be more user-friendly.
The U.K.’s National Cyber Security Centre (NCSC) has launched its “Zero Trust Architecture Design Principles,” providing guidance to help entities design and review a zero trust architecture that meets their unique requirements.
Microsoft has published guidance for mitigating “PetitPotam,” which is described as a classic NTLM Relay Attack that exploits a security flaw in the Windows operating system. If successfully exploited, it forces remote Windows servers to authenticate with an attacker and share NTLM authentication details or authentication certificates.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Alerts, Updates, and Bulletins:
July 21, 2021
The Cybersecurity and Infrastructure Security Agency (CISA) updated the Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department advisory with a caveat providing clarification on the original indicators of compromise (page 7).
July 19, 2021
The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2021 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses list. At first blush, this list may seem more relevant to the IT/business applications side of your utility – and you aren’t wrong.
Pulse Connect Secure (PCS) SSL VPN - Vulnerabilities being Actively Exploited - Updated July 22, 2021
Reminder: If your utility uses Ivanti Pulse Connect Secure (PCS) SSL VPN, WaterISAC highly recommends tracking and reviewing current notifications/alerts/advisories for important developments.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Alerts, Updates, and Bulletins:
In the survey conducted by the Water Sector Coordinating Council, Cybersecurity: 2021 State of the Sector, participants were asked about concerns regarding the exchange of organizational information on cybersecurity threats, vulnerabilities, mitigation, and security incidents with external organizations. While over 30% identified no barriers, 60% noted lack of know-how (37.76%) and lack of trust around maintaining confidentiality of information shared (22.39%).
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
