Op-Ed Urges Stronger Cybersecurity for U.S. Water Systems
Summary
An op-ed argues that attacks on water systems in 12 states exposed major security gaps and calls for federal support, zero-trust architecture, safer software, and AI-enabled defenses for utilities.
Key points
- The article says Iranian hackers targeted water systems in 12 states, exposing weaknesses in the sector.
- It reports that about 80% of U.S. water systems lack basic cyber hygiene, while many small utilities have limited staff and funding.
- The EPA has limited authority to impose broad cybersecurity requirements; a 2023 effort to strengthen requirements was withdrawn after opposition and legal challenges.
- The authors propose a five-part federal program, including zero-trust adoption, more secure software, and funding and technical support for utilities of different sizes.
- The article cites exposed remote-access devices as a key risk and discusses guidance to disconnect operational technology from the internet where feasible and strengthen passwords.
- It recommends an AI-capable cybersecurity cohort to help utilities deploy defenses and identify or repair software vulnerabilities.
Article Details
- Topic
- Cybersecurity vulnerabilities and proposed federal defenses for U.S. water systems
People
Adam SchiffU.S. senator identified as a sponsor of the proposed Water Safety Shield Act.Amy KlobucharU.S. senator identified as a sponsor of the proposed Water Safety Shield Act.Franklin D. KramerCo-author of the article; a former assistant secretary of defense for international security affairs.Melanie J. TeplinskyCo-author of the article; an adjunct professor and senior fellow in the Technology, Law and Security Program at American University’s Washington College of Law.Robert J. ButlerCo-author of the article; co-founder and managing director of Cyber Strategies LLC, with prior cybersecurity-related government and corporate roles.
Threat Actors
Vendors
AnthropicAdvanced AI models, such as Anthropic’s Claude Mythos, have demonstrated the ability to identify thousands of zero-day vulnerabilities in critical software systems, including major operating systems and browsers.CrowdStrikeAI tools developed by companies including Google and CrowdStrike can identify and help repair software vulnerabilities, a process sometimes called “code mending.” Water systems should use such tools to defend againstGoogleAI tools developed by companies including Google and CrowdStrike can identify and help repair software vulnerabilities, a process sometimes called “code mending.” Water systems should use such tools to defend againstRockwell AutomationBut much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation.Schneider ElectricBut much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation.SiemensBut much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation.