The Cybersecurity and Infrastructure Security Agency (CISA) has reported that over 100 internet-exposed water systems were targeted in cyberattacks during July. The agency has subsequently issued guidance aimed at assisting organizations in reducing their internet exposure, particularly in light of these recent incidents which CISA attributes to Iran-linked threat actors.
These attacks reportedly focused on water systems that were directly accessible from the public internet. Such exposure can arise from various factors, including misconfigured network devices, unpatched vulnerabilities in internet-facing equipment, or the intentional placement of operational technology (OT) components on the public internet without adequate protective measures. The direct accessibility of these systems significantly lowers the bar for attackers, allowing them to potentially scan for, identify, and attempt to exploit known weaknesses or default credentials.
The technical mechanism of these attacks was not detailed, but targeting internet-exposed systems often involves reconnaissance scans to identify vulnerable services, open ports, or specific device fingerprints. Once identified, attackers might attempt to leverage known exploits for software running on these systems, brute-force weak credentials, or exploit default configurations. For water systems, this could involve programmable logic controllers (PLCs), human-machine interfaces (HMIs), or remote terminal units (RTUs) that are inadvertently exposed.
The affected products or vendors were not specified, but water systems commonly utilize a range of industrial control systems (ICS) and supervisory control and data acquisition (SCADA) components from various manufacturers. These systems are designed for operational control and monitoring, and when exposed to the internet without proper segmentation or security controls, they can become targets. The scope of over 100 targeted systems suggests a broad scanning effort rather than highly specific, tailored attacks against a few high-value targets.
Typical mitigation guidance for this class of issue revolves around robust network segmentation, ensuring that operational technology networks are isolated from enterprise IT networks and the public internet. Implementing strong access controls, multi-factor authentication for remote access, and regularly patching and updating all internet-facing systems are critical. Additionally, organizations are advised to conduct regular vulnerability assessments and penetration tests to identify and remediate exposures proactively.
The CISA guidance likely emphasizes the importance of minimizing the attack surface by reducing unnecessary internet exposure. This includes reviewing firewall rules, disabling unused services, and implementing secure remote access solutions such as VPNs with strong encryption and authentication. Monitoring network traffic for unusual activity and maintaining comprehensive asset inventories are also standard recommendations to enhance resilience against such threats.
This incident underscores the ongoing challenge of securing critical infrastructure, particularly against state-sponsored or state-aligned threat actors. The targeting of internet-exposed operational technology highlights a persistent vulnerability across various sectors, emphasizing the need for continuous vigilance, adherence to cybersecurity best practices, and proactive measures to protect systems that are vital for public services.
