CISA and partners updated the recent Fact Sheet – Top Cyber Actions for Securing Water Systems – with resources from water and wastewater systems sector organizations, including WaterISAC. The resources are intended to help support water systems in defending against malicious cyber activity. They include:
CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – February 27, 2024
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Next week, on Tuesday February 27, at 2 p.m. ET, EPA is hosting a free virtual webinar on physical security and cybersecurity threats to the water and wastewater sector. The briefing will be unclassified, and no clearance is required. WaterISAC staff, along with other federal partners, will be conducting the brief.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – February 22, 2024
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Unit 42 published its 2024 Incident Response Report yesterday which includes incident data from over 250 organizations and more than 600 incidents. The report provides a unique perspective into the latest threat tactics being used by attackers and provides helpful resources and methods for effective defense.
Cofense, a leading cybersecurity firm in email security, recently released its 2024 Annual State of Email Security Report. The report reveals emerging trends in the email threat landscape, such as an increase in various phishing tactics. Most notable, the report indicates a significant (37%) increase in malicious emails that are bypassing secure email gateways (SEGs) over last year, and an overwhelming 310% increase since 2021.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
The U.S. EPA OIG issued a fraud alert (attached) to highlight the all-too-common and costly form of phishing known as business email compromise (BEC). In this convincing scam, criminals are using fraudulent emails that appear to come from known and trusted sources to access company email accounts and target organizations that make or receive financial transactions. These emails may originate from lookalike, or spoofed, email accounts or legitimate email accounts compromised through phishing campaigns.
CISA recently shared its “Cybersecurity Emotions” series detailing social engineering tactics that threat actors often use when implementing various tactics against organizations and internet facing users. Organizations can add CISA’s “Cybersecurity Emotions” to security awareness training as each of the “emotions” are effectively described and explained giving relatable real-world understanding of these tactics and helping users learn the basics of “cyber hygiene.”
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
