The White House announced today it will extend the Industrial Control Systems (ICS) Cybersecurity Initiative to the water sector, as part of a larger effort to set cybersecurity baselines for critical infrastructure and protect it from cyber threats.
The White House developed the Water Sector Action Plan in partnership with the Environmental Protection Agency (EPA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Water Sector Coordinating Council (WSCC). The administration plans to implement the action plan over the next 100 days.
“The expansion of the President’s ICS Cybersecurity Initiative to the water sector is an important step forward in securing our nation’s water utilities from malicious cyber activity,” said National Cyber Director Chris Inglis.
“The water sector action plan will provide owners and operators of water utilities a roadmap for high-impact actions they can take to improve the cybersecurity of their operations,” Inglis added. “I commend the Water Sector Coordinating Council and their Federal partners for their continuing efforts to improve the present and future resilience of water utilities on which each American depends.”
The administration has already established ICS initiatives for the electric and natural gas pipeline subsectors, but the water sector has also become a recent target for cyberattacks.
Just last year, a water treatment facility in Oldsmar, Fla., became the victim of a cyberattack when hackers attempted to increase the amount of sodium hydroxide – commonly known as lye – to lethal levels. Thankfully, water treatment personnel noticed the change in chemical levels and the water treatment process was able to return to normal.
The new action plan will assist owners and operators within the water sector with deploying technology that will “monitor their systems and provide near real-time situational awareness and warnings,” allowing them to quickly detect future compromises.
The action plan will also share relevant cybersecurity data with the government and other stakeholders; invite water utilities to participate in a pilot program with CISA and EPA for ICS monitoring and information sharing; and allow collaboration between the government and appropriate private sector partners to develop protocols for sharing cyber information.
Initially, the action plan will focus on the utilities that serve the largest populations and have the biggest impact, the White House said. However, the plan will lay the foundation for supporting ICS cybersecurity “across water systems of all sizes.”
