Dayton’s drinking water systems have layers of security to curb hacking, officials say
“This is what we do,” Powell said.
The city of Xenia water treatment plant’s SCADA also is not connected to the internet because of security reasons, said Joe Bates, water treatment supervisor.
A hacker gained entry to the system controlling the water treatment plant of a Oldsmar, a Florida city of 15,000, and tried to taint the water supply with a caustic chemical, exposing a danger cybersecurity experts say has grown as systems become both more computerized and accessible via the internet.
The hacker who breached the system at the city of Oldsmar’s water treatment plant on Friday using a remote access program shared by plant workers briefly increased the amount of sodium hydroxide by a factor of one hundred (from 100 parts per million to 11,100 parts per million), Pinellas County Sheriff Bob Gualtieri said during a news conference Monday.
Experts say municipal water and other systems have the potential to be easy targets for hackers because local governments’ computer infrastructure tends to be underfunded.
Robert M. Lee, CEO of Dragos Security, and a specialist in industrial control system vulnerabilities, said remote access to industrial control systems such as those running water treatment plants has become increasingly common.
“As industries become more digitally connected, we will continue to see more states and criminals target these sites for the impact they have on society,” Lee said.
Eight years ago Dayton officials made the decision not to put the computer systems that control its water plants on the internet because they noticed cybersecurity threats were on the rise, Powell said. The city also joined associations such as the Water Information Sharing and Analysis Center ― WaterISAC ― that alerts them whenever threats or other issues emerge relating to drinking water.
About 6 a.m. Tuesday, Powell received an alert from WaterISAC informing him about the breach in Florida and recommending eight action steps water utilities needed to take immediately to avoid similar hacks. Powell reviewed the list and said Dayton had already taken all those steps, he said.
Source…
