There is an old saying in the cybersecurity field: There are two types of people. Those who have been hacked, and those who do not know they have been hacked. While someone hacking into your home network may not worry you, if a water district’s operational systems are hacked, a whole lot of chaos could ensue.
Some may say that I am overreacting, but consider this news item about a water system in Pennsylvania. The Municipal Water Authority of Aliquippa, Pennsylvania confirmed that foreign hackers had taken control of a booster station over the weekend. The hack was perpetrated by an Iran-influenced group called Cyber Av3ngers.
From looking at the Aliquippa Water Authority’s website, it also appears that they have been the target of a spoofing campaign, which sought to direct the Water Authority’s customers to a fake billing site, that was not associated with it.
This illustrates the two types of attacks that water districts need to be aware of. The first type of attack is on the systems that control SCADA systems. These systems control the “physical” plant for water districts. This means all of the dams, reservoirs, water treatment plans, and water purification centers. Hostile control of these systems could lead to a physically disastrous event. The second type of attack is on the financial systems a water district controls, like its accounting systems, or its payments systems. Hostile control of these systems could lead to a financially disastrous event.
Why does this matter to Sant Clara Valley Water District? Lets make this real. The district has SCADA systems for its collection of dams, reservoirs, water treatment plans, and water purification centers. Imagine if a hostile foreign actor got into the Valley Water network and was able to open the floodgates of Almaden Dam, located in New Almaden, south of San Jose. This map shows a model of what the worst flooding would look like. Thousands of homes and millions of dollars would be lost.
The Santa Clara Valley Water District need board-level leaders who are aware of the breadth and complexity of cybersecurity issues, and can have the foresight to deploy resources to stop the threats. Bill Roth is the leader who will do this.
For more information, please subscribe to our Newsletter, here:
