In a letter to all U.S. governors, National Security Advisor Jake Sullivan and Environmental Protection Agency (EPA) Administrator Michael Regan said recent threats from hackers affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) and the People’s Republic of China (PRC) have exploited vulnerabilities that compromised water systems throughout the country. Iranian hackers have carried out attacks that targeted and disabled a type of technology used at water facilities where workers neglected to change a default manufacturer password, Sullivan and Regan wrote. China’s hackers are engaging in behavior that is “not consistent with traditional cyber espionage,” they said. The letter explained that these actors are “pre-positioning themselves to disrupt critical infrastructure operations in the event of geopolitical tensions and/or military conflicts.” Sullivan and Regan wrote, “Drinking water and wastewater systems are an attractive target for cyberattacks because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices.” In a separate statement, Sullivan said, “The Biden Administration has built our national security approach on the foundational integration of foreign and domestic policy, which means elevating our focus on cross-cutting challenges like cybersecurity. We’ve worked across government to implement significant cybersecurity standards in our nation’s critical infrastructure, including in the water sector, as we remain vigilant to the risks and costs of cyber threats. We look forward to continuing our partnership with the EPA to bolster the cybersecurity of America’s water and wastewater systems.” The EPA has invited governors and state environmental, health and homeland security secretaries to participate in a virtual meeting on March 21st to discuss the “urgent need to safeguard water sector critical infrastructure against cyber threats.” The EPA will also form a task force that will identify the most significant vulnerabilities of water systems to cyberattacks, as well as cybersecurity best practices, and short and long-term strategies to minimize risk. “We need your support to ensure that all water systems in your state comprehensively assess their current cybersecurity practices to identify any significant vulnerabilities, deploy practices and controls to reduce cybersecurity risks where needed, and exercise plans to prepare for, respond to, and recover from a cyber incident,” the letter advised.The Biden administration is urging states to step up security measures following cyberattacks that have targeted U.S. water and wastewater systems.
