Remote alarm notifications add firewall as utilities face mounting threats of cyberattacks

Municipal utilities are critical to national security, economic stability, and public health and safety. As technology in these sectors evolves, cyberattackers take advantage of opportunities to exploit vulnerabilities. While the Federal Government has taken steps to address this issue by creating innovative public-private partnerships and initiatives, the worldwide attacks on municipal utilities in the past year have virtually doubled. Additionally, because of the geopolitical unrest, cyberattacks have become such a threat that President Biden has urged private sector partners to immediately harden cyber defenses.

Remote alarm notification software offers additional security

A report by the American Water and Works Association, “Cybersecurity Risk & Responsibility in the Water Sector,” states that “…Failing to address cybersecurity risk in a proactive way can have devastating results. Failing to take reasonable measures and employ best practices to prevent, detect, and swiftly respond to cyber-attacks means that organizations and the people who run them will face greater damage—including technical, operational, financial and reputational harm—when the cyberattacks do occur.”

Utilities face myriad challenges to managing cyber risk due to varying infrastructure and entities of vastly different sizes, capabilities, resources and types of ownership. However, turning to additional technology is one answer.

Although replacing legacy systems and networks can be extremely costly, it is essential to work with vendors and cybersecurity experts to implement updates and, if necessary, overhauls of outdated systems. Invoke the help of internal or external advisors to prioritize risks and develop a realistic approach and plan for enhancing cybersecurity. At a minimum, utilities must comply with basic standards including restricted physical and technical access, firewalls, logging and encryption.

Many Supervisory control and data acquisition (SCADA) systems are simply over-exposed to the internet by remote desktop applications (e.g. RDP and TeamViewer). To offer process and asset information to operators, organizations have provided much more, ignoring the principle of least privilege and opening their entire control systems and their hosts to remote desktop access by unnecessary parties. Such broad remote access techniques present an increased security risk for organizations, a risk that Oldsmar experienced firsthand when an improperly secured TeamViewer application allowed an unauthorized party to increase the amount of sodium hydroxide being added to their water treatment process.

Advanced remote alarm notification software allows remote operators access to only the information they need from SCADA but not access to the SCADA itself or its operating system host. Such notification software is compatible with more secure, layered networks in which a series of firewalls provide added protection from attacks. This is done by deploying notification solutions alongside the SCADA system at the network’s control level and using notification modalities that are not internet facing or distributing internet-facing notification processes to higher levels. For example, internal email servers, SMS modems and voice via PBX devices allow communication with the outside world without internet exposure. Likewise, distributing the processes that interface with SCADA from those that interface with external email servers, VoIP solutions and cloud apps allows internet-based notifications without compromising security.

Of course, there are valid use cases for desktop sharing software that do not violate PoLP and go well beyond operator access to process information. For such systems it’s critical that the remote desktop solutions be implemented with sound security.

Utilities should also take steps to secure any remote access software. They should not use unattended access features, and IT leaders should configure the software such that the application and associated background services are stopped when not in use. Integrating the remote alarm notification software through the SCADA system is critical to further reducing cyberattacks.

The new normal

According to McKinsey & Company’s report, Critical resilience: Adapting infrastructure to repel cyber threats,cyberattacks should be thought of as a certainty akin to the forces of nature. Just as engineers must consider the heaviest rains that a dam may need to contain in the next century… those digitizing infrastructure must plan for the worst in considering how an attacker might abuse or exploit systems that enable infrastructure monitoring and control. This shift in thinking will begin to lay the path to connected infrastructure that is resilient by design.

Cody Bann is director of engineer at Austin-based WIN-911 and may be reached at [email protected]. The company helps protect more than 18,000 facilities in 80 countries by delivering critical machine alarms via smartphone or tablet app, voice (VoIP and analog), text, email, and in-plant announcer, reducing operator response times, system downtime, and maintenance costs. For more information, visit www.win911.com/.