462
CISA Releases Guidance Urging Water Treatment Facilities to Disconnect Equipment From the Internet (www.privacyguides.org)
submitted 3 months ago by to c/technology@lemmy.world
64 comments fedilink hide all child comments
 

CISA released an urgent message warning water utilities to disconnect their logic controllers from the internet in the face of rising cyberattacks.

The hacks target internet-facing programmable logic controllers (PLCs) that control equipment and allow machinery to communicate. They monitor and control the water pressure, chemical dosing, and other factors to ensure the water is safe.

Many of the PLCs are apparently open to the internet and use default credentials, allowing a remote attacker to easily take them over.

I assume it is this CISA: https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency

you are viewing a single comment's thread
view the rest of the comments
[–] 40 points 3 months ago (14 children)

I will take things that never should be connected to Internet for $200 Alex.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 19 points 3 months ago (7 children)

    Remote monitoring? Sure. Remote managing? Fuck that. These facilities shouldn't be unstaffed for days at a time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 8 points 3 months ago (3 children)

    It's called paying people to watch the systems during off-hours. It's often way cheaper than setting up firewalls, setting up alerts, maintaining patches, paying a VPN company to manage connections, paying another company to handle authentication, and so on. Security constraints are getting so bad at my office I'm seriously thinking of how we can do more things with pen and paper.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 3 months ago (1 child)

    The things you mentioned probably aren't the problem. It's not hard or expensive to setup secure remote access for systems.

    The real problem is that a lot of this very expensive and very specific infrastructure equipment is also very old, and frequently does not support newer and more secure protocols.

    Source : I've been trying to get gas generators to fire off email alerts using modern authentication with conditional access for about a week now.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 months ago

    Changing tech is usually a lot harder than adoption. Better methods and protocols will keep emerging to fight new digital threats but with physical threats usually don't change. Only exception is social engineering (e.g. attacking a locked door by tricking someone into opening it). Even then a physical presence is required and someone can't enter a locked room from 2000 miles away.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 3 months ago (2 children)

    Oh for sure, air gapped sensors that relay information are going to be necessary. We should be building these systems with absolute security because they are critical to infrastructure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 3 months ago (1 child)

    Some people will say it's too hard to retrofit onto legacy equipment, but all it really means is adding a secondary system on top of the legacy system. Just a sensor array that has no interaction with existing systems.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 3 months ago (3 children)

    Right. Why would you do this? Monitoring being available on the Intranet, of course. But controllers on the open internet?

    Might as well really focus on ease of use and just make a live website with one big button that says "cut off all electricity and turn all the water into poison, lol"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •