Plan ahead High Check your exposure
Iranian hackers claim attacks on US water systems
Modern Ghana (via Google News)water
What happened. Iranian hackers claim they attacked US water systems. Minnesota systems are reported to have gone offline. The report gives no confirmation that the claim is true and no technical details.
Who is affected. US water sector organisations, including systems in Minnesota. The source does not say which organisations are affected.
What to do. Check whether your water control systems are reachable from the internet and review who can connect remotely.
When to act. Plan ahead: Water operators: reports are early and unverified; check remote access to your HMIs.
Editor's reading
Forasset ownerOT security leaddetection engineer
- Purdue level
- L3.5
- L2
Why: The report names no component. Water-system attacks often involve internet-reachable HMIs and remote-access paths (L2, L3.5), but this is an inference.
- Are you exposed?
Search your internet-facing address ranges for exposed HMIs, SCADA servers or remote-access services and list who uses them.
- If you cannot fix it yet
- Take any HMI or control system found on the internet off it, or place it behind a VPN with multi-factor authentication.
- Limit remote access to named users and known source addresses.
- Watch for
- Logons to HMI or SCADA hosts from unknown external addresses.
- Unexpected changes to setpoints or settings, or systems going offline without a planned reason.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Modern Ghana (via Google News) (opens news.google.com)
More on Water and wastewater