Attacking the Water Treatment Plant

Our infrastructure systems are more vulnerable to bullets, bad guys, and PhD Russian computer science experts than people are willing to admit.  If Target has trouble (and they have a huge motivations to avoid trouble), just how safe are the energy and water systems from a well coordinated attack?  The Internet of Things will have many doors and windows - people and organizations will have plenty of motivation and the correct skill sets to find all these openings.  

From WaterWorld:

"DENVER, CO, Feb. 12, 2014 -- Today, the American Water Works Association (AWWA) announced the release of expert guidance on how water and wastewater utilities can reduce their cyber vulnerabilities, in light of growing cyber-attacks that pose a threat to critical infrastructure systems.

This guidance, "Process Control System Security Guidance for the Water Sector," was prepared to provide water utility managers with a concise set of best practices and standards. Further, it applies a transparent and repeatable process for evaluating a utility's process control system. In order to provide the widest benefit, the guidance and tool are free and publicly available.

"Our water systems are essential to the health and safety of our communities and citizens," said AWWA Executive Director David LaFrance. "AWWA's new cybersecurity guidance and tool can help the nation's water utilities mitigate potential risks introduced by today's advanced technologies."

Cybersecurity is the top threat facing business and critical infrastructure in the United States, according to reports and testimony from the National Intelligence Agency, the Federal Bureau of Investigation and the Department of Homeland Security. On Feb. 12, 2013, President Obama issued Executive Order 13636 - Improving Critical Infrastructure Cybersecurity, which directed the National Institute of Standards and Technology to work with stakeholders to develop a voluntary framework for reducing cyber risks. AWWA's new program is a product of that effort.

Supporting the guidance is the Cybersecurity Use-Case Tool, which offers an efficient approach to evaluating the security of cyber systems and networks of water utilities. Both the tool and guidance were prepared with leadership from AWWA's Water Utility Council. Additional background and a demonstration of the use-case tool will be the focus of a webinar, "An Action Plan for Process Control System Security," on Wednesday, Feb. 26, 2014."