The US Cybersecurity and Infrastructure Security Agency (CISA) this week announced a new vulnerability scanning service designed to help water utilities identify and address security holes that could expose their systems to remote attacks.
Water utilities can subscribe to this service for free by sending an email to CISA. The scanning begins within 10 days of the necessary paperwork being done.
The free vulnerability scanning service for water utilities covers both drinking water and wastewater systems. It leverages automated tools to identify internet-exposed assets and discover vulnerabilities in those assets, including newly emerged vulnerabilities, known exploited flaws, and common attack vectors.
Organizations using the service are provided weekly reports with the results of the scan and recommendations for mitigating vulnerabilities. In the case of urgent findings, organizations receive alerts within 24 hours and the target is rescanned every 12 hours.
According to CISA, the benefits of the scanning service include a significant reduction in vulnerabilities in the first few months for newly enrolled organizations.
“CISA’s scanning provides an external, non-intrusive review of internet-accessible systems. The scanning does not reach your private network and cannot make any changes.” CISA explained in a fact sheet.
Cyberattacks aimed at the water sector are not uncommon and there have been confirmed reports of attacks impacting industrial control systems (ICS) at water facilities.
A recently proposed bipartisan bill proposes to increase cybersecurity funding for rural water systems by $7.5 million dollars per year.
CISA Announces Free Vulnerability Scanning for Water Utilities
CISA announced a new vulnerability scanning service designed to help water utilities identify and address security holes that could expose their systems to remote attacks.
All ICS Vendors Impacted by OT:Icefall Vulnerabilities Have Released Advisories
All ICS vendors impacted by the recently-disclosed OT:Icefall vulnerabilities have released advisories to inform customers about the impact of the flaws and to provide mitigations.