Water Sector Faces Persistent Cyber Threats After Summer Attacks
The computers that automate water treatment systems across the United States were designed for durability in an era before widespread internet connectivity, leaving many operational technology (OT) systems vulnerable to modern cyber threats. As cyberattacks on the water sector intensified this summer, industry officials highlighted aging infrastructure — particularly internet-exposed OT and programmable logic controllers (PLCs) — as primary entry points for adversaries.
WaterISAC Identifies Key Vulnerabilities in Water Infrastructure
Tom Dobbins, executive director of the Water Information Sharing and Analysis Center (WaterISAC), told CyberScoop that the sector’s most persistent weaknesses include exposed operational technology, vulnerable programmable logic controllers, insecure connections through third-party integrators, and inadequate cyber hygiene at smaller utilities. These vulnerabilities have driven WaterISAC to accelerate threat intelligence sharing across the sector.
"We have been under attack, and our enemies, the threat actors, are stepping up their activity as the U.S. is involved in a number of conflicts around the world,"
— Tom Dobbins, Executive Director, WaterISAC
Dobbins noted that threats are not limited to one nation-state, citing activity from Iran, China, and Russia. While the U.S. government has attributed some of this summer’s attacks to Iran, former President Donald Trump has publicly disputed that assessment. Dobbins responded by suggesting that agencies like the Cybersecurity and Infrastructure Security Agency (CISA) possess greater expertise in cyber attribution than political leadership.
Programmable Logic Controllers Remain a Critical Weakness
According to Dobbins, programmable logic controllers (PLCs) are an obvious vulnerability point and were among the most commonly exploited weaknesses in this summer’s attacks. Many PLCs date back to a "simpler, gentler time" when cyber threats were not a design consideration. Despite their age, these devices remain operational and valuable, reducing the incentive for utilities to replace or isolate them from the internet.
"OT systems that are exposed to the internet are a major challenge, and many of these systems that are older generation need to be not accessible to the internet,"
— Tom Dobbins, Executive Director, WaterISAC
Across the sector, PLCs have served as the "main point of entry" for hackers, largely because they were developed before the rise of modern cyber threats.
Integrators and Human Factors Increase Risk
Beyond technical flaws, Dobbins identified two additional sources of vulnerability: external integrators and internal employees. When integrators maintain connections to OT systems without proper segmentation, threat actors can exploit those links to gain access. Similarly, well-meaning employees who click on malicious links in phishing emails can inadvertently compromise systems.
At smaller utilities, maintaining basic cyber hygiene — such as regular password changes and implementing multifactor authentication — remains a persistent challenge due to limited staffing and resources.
WaterISAC Announces Partnership with Cyware to Enhance Threat Sharing
In response to these challenges, WaterISAC announced a partnership with Cyware on Wednesday to leverage its threat intelligence platform. Dobbins said Cyware was selected partly due to its established relationships with other industry information sharing and analysis centers (ISACs), which will help WaterISAC analysts improve their capabilities.
WaterISAC already collaborates with the National Rural Water Association to support approximately 20,000 of the smallest water utilities in the United States. The Cyware partnership aims to extend and enhance this reach by enabling faster, more effective cross-sector threat sharing.
Cyware Sees Opportunity to Expand Critical Infrastructure Support
Tom Stockmeyer, managing director of government and critical infrastructure at Cyware, expressed enthusiasm about bringing the water sector into Cyware’s portfolio. He stated that the collaboration would enable cross-sector sharing and strengthen defenses across critical infrastructure.
"We’re thrilled to add water to the portfolio and start enabling cross-sector sharing,"
— Tom Stockmeyer, Managing Director of Government and Critical Infrastructure, Cyware
The water sector continues to lag behind other industries in cybersecurity protections, largely due to financial and technological constraints. By improving threat intelligence sharing through platforms like Cyware’s, WaterISAC aims to close that gap and better protect essential water treatment systems from future attacks.
Source: CyberScoop