We take our community water supplies for granted, but these days we probably shouldn’t.
Not all industrial accidents are caused by terrorists. Some are actually caused by... accidents. In the era of the Industrial Internet, someone hitting the wrong button can be as devastating as a state-sponsored attack. Unfortunately, accidents happen more often than you might expect.
For example, earlier this year, an unintentional key stroke by an operator at a water plant in North Carolina caused an overfeed of fluoride into the water supply. The plant was forced to shut down immediately.
According to IndyWeek, the extra fluoride dosage – along with the subsequent water main break – prompted a county-wide water shortage that forced businesses to close and placed two municipalities under a state of emergency. The population was unable to use or drink their water for more than 24 hours. The only positive outcome was the spike in sales of bottles of spring water.
A cyber forensics report states the operator accidentally instructed the plant's fluoride feed pump to increase its feed rate to 80 percent. The normal operating range is 8–12 percent. (Flouride is added to the water in many communities for dental hygiene.)
The operator noticed the error almost immediately and, 12 seconds later, tried to change the command. But, according to the report, the change didn't register. Further, a lead operator at the plant noticed the extra high levels, but their corrective actions didn’t have an impact until later in the day. All told, the pump operated at the increased feed rate for almost three and a half hours.
According to the forensics, a fluoride level of 5.90 mg/L was recorded at the plant that day. That exceeds state and federal primary drinking water standards by 1.9 mg/L.
Water utilities are particularly vulnerable
While accidents will happen, of course the greater threat to the water-consuming population is coordinated cyber-attacks. And, like accidents, attacks on the worldwide water supply are more common than you might think. Beyond the threat to human life, there are economic costs as well. According to Frost & Sullivan (2017), the average financial impact of a cyber-attack on utilities, including the water industry, is $7.6 million.
While clean water is critical to the daily life of all of us, there are risks to taking it for granted. Water utilities are particularly exposed to the hazards of the Internet, having become more reliant on the Internet to operate their networks of pipes and pumps. Because it is consumed by almost all the people all the time, water is an obvious target for cyber terror. Today, it is relatively easy for a cyber attacker to exploit vulnerabilities in the software applications that run industrial controls such as water valves and plant controls.
These vulnerabilities have started to raise global awareness. The US and the UK are at the forefront of recognizing and addressing the issue. In the US, the Environmental Protection Agency is working with the Department of Homeland Security to conduct research and develop municipal strategies in four water-related areas:
- Drinking and wastewater infrastructure protection
- Support for utilities in contaminant detection
- Containing contamination and mitigating impacts, and
- Water treatment and infrastructure decontamination.
The UK’s Department for Environmental Food & Rural Affairs has begun to take steps as well. The department’s recent Water Security Cyber Security Strategy report acknowledged that “a number of threat actors including terrorists, hacktivists, criminals and foreign intelligence services can use cyberspace as a means to exploit vulnerabilities and cause damage. This could manifest itself in a number of ways, including through the disruption of water supply or affecting the quality of the water supply. Technological developments have increased the attackers’ reach and made their identification more difficult.”
The department is pursuing proactive measures, including:
- Common cyber security management of IT and OT
- Cybersecurity and awareness training
- Proactive monitoring, and
- Cyber incident response planning and exercising.
How to avoid a repeat occurrence
Like many industrial malware programs of the StuxNet ilk, such as Industroyer and CrashOverride, the North Carolina accident was caused by dangerous commands sent to a machine. Fortunately, advanced technology already exists to protect water utilities and treatment plants from both accidents and cyber-attacks that do their dirty work this way.
The Bayshore Industrial Cyber Protection (ICP) platform, for instance, is designed to provide visibility into machine instructions and sensor data. It constantly inspects sensor variables such as water quality, water levels, water flows, and machine performance data, such as the speed of the fluoride pump. With just a few simple policy rules, Bayshore ICP can set ranges for safe performance (e.g., 8-12% pump speed, fluoride level of 5.90 mg/L), and notify operators immediately when bad instructions are sent.
Bayshore’s granular inspection also enables the identification of anomalies in machine behavior in real-time. This means it can prevent (and block) dangerous commands, even if they are coming from an attack vector that is not recognized by threat intel. Additionally, this capability helps operators to circumvent malware programs that cleverly report that all is well after launching an attack. In these ways, the Bayshore platform proactively protects water utilities from attack.
There is another benefit to Bayshore ICP -- the enormous quantities of machine transaction data aggregated and filtered by the Bayshore platform is extremely valuable for business and performance analytics. Bayshore policy can transform industrial data into formats consumable by cloud-based analytics and management applications. This enables water utilities to identify and prioritize capital and OPEX reduction initiatives to improve overall processes efficiencies, ensure water cleanliness, and provide water safety. In these ways, the Bayshore platform ensures safe and efficient operation of water utilities and treatment plants.
The idea is to make sure we’re safe to drink the water again.
Ready to take advantage of these benefits?
- Protection of individual water system components from accident or attack
- End-to-end management of utility-wide operational processes
- Insight into operational and business performance
- Improved water cleanliness and safety via advanced analytics
- System availability and downtime avoidance
- Reduced risk of service disruptions.
As Chief Marketing Officer at Bayshore Networks, Kirby is on a mission to educate and inspire leaders to act now to protect our industrial infrastructure - and our way of life - from cyber threats. Bringing more than two decades of executive leadership in both public enterprises and emerging startups, Kirby is a published author, keynote speaker, teacher, and frequent contributor to over 20,000 online followers.