Cybersecurity

WaterISAC is aware of several reports of threat actors leveraging multiple vulnerabilities to exploit unpatched systems in the water and wastewater sector. Members are encouraged to review and address the following vulnerability advisories and updates for products used within their environments.

In April 2021, the Water Sector Coordinating Council conducted a survey of U.S. water and wastewater utilities to better understand the sector’s cybersecurity challenges and needs.

The responses demonstrate that many utilities are implementing cybersecurity best practices, but many others’ cybersecurity programs are incomplete. 

The much anticipated Top 20 Secure PLC Coding Practices was released today. This list is reportedly the brain-child of water sector veteran Jake Brodsky and was presented during an S4x20 Conference session. According to Dale Peterson, as this initiative was too important to slip away, he made it an official S4 project to organize and recruit engineers who could create a quality list. The coding practices are intended to be used by automation engineers and technicians that program and maintain PLCs.

With all the ransomware activity in recent weeks, there is no shortage of developments and disclosures - from more ransomware groups claiming to call it quits to lesser discussed facets about ransomware negotiations. If you haven’t experienced a ransomware incident, it is prudent to keep up with current evolutions and considerations to potentially include with your ransomware response planning. Some of the more significant developments last week include: