The Municipal June 2021

M Focus on: Water & Energy

Protecting your water utility from cyber threats

By DENISE FEDOROW | The Municipal

Oldsmar, Fla., averted a potential catastrophe in February when someone breached the computer system at the Bruce T. Haddock Water Treatment Plant and changed the levels of sodium hydroxide from 100 parts per minute to 11,100 ppm.

An operator monitoring the system happened to see the cursor moving across the screen and corrected the levels.

“That’s called getting lucky,” Kevin Morley, manager of federal relations for American Water Works Association, said.

During a press conference organized by the sheriff and city officials following the event, Pinellas County Sheriff Bob Gualtieri said it was an “unlawful intrusion” to “part of the nation’s critical infrastructure.”

The perpetrator actually made two attempts.

The first was at 8 a.m. Feb. 5, but it was very brief, and the operator thought maybe supervisors were accessing the system through remote access. At 1:30 p.m., the system was again breached, but this time the perpetrator changed the amount of sodium hydroxide — a Kevin Morley, caustic ingredient in drain cleaners — to “sigmanager of federal nificant and dangerous levels,” according to relations for Amerithe sheriff. can Water Works The sheriff and city officials — Mayor Association Eric Seidel and City Manager Al

22 THE MUNICIPAL | JUNE 2021

ABOVE: Vigilance is key to preventing cyberattacks on water utilities. Water utilities should focus on implementing best security practices, such as avoiding exposure of critical assets to the internet, establishing redundancy mechanisms for critical assets, employing strict access control policies and raising security awareness among employees. (Shutterstock.com)

Braithwaite — stressed residents were never in danger because even if the cyber attack had not been detected, there are other controls in place that would’ve set off alarms before the increased ingredient could have entered the drinking water system. They also noted it takes 24-36 hours to hit the water system. At the time of the press conference on Feb. 8, Sheriff Gualtieri said they didn’t know whether the threat came from inside or outside the country.

The FBI is still investigating the incident, so when called, Oldsmar’s assistant city manager said, “We’re not engaging in any conversations on that topic at this time.”

During the press conference, Braithwaite responded to a reporter’s question by stating, “We anticipated this day coming — we talked about it and studied it.”

However, Morley said the Oldsmar system had no firewall and a weak password, so “it didn’t require a lot of sophistication to hack it.”

In a press report days after the incident, an FBI investigator was cited as stating the cyber actors likely accessed the system by exploiting cybersecurity weaknesses, including poor password security and an outdated Windows 7 operating system, and they likely used a shared software, Team Vision, to gain unauthorized access to the system.