Water and wastewater utilities (and their affiliates) need to start addressing cybersecurity issues as an integral part of their ongoing maintenance plans. Time is running out to think otherwise.

1. The
Maintenance
You Don’t Have
to Touch
Brian Gongol, M.Ed.
DJ Gongol & Associates
Iowa AWWA Short Course | Ankeny, Iowa
March 1, 2023

2. Willie Sutton robbed banks because
“that's where the money is"

3. Water-sector
utilities are
attractive
cybersecurity
targets

4. Federal
government
increasingly
recognizes the
threat

5. Federal
funding is
increasing

6. CISA and
other agencies
have been
established

7. Trade groups
are
recognizing
the threat

8. AWWA cyber
advisories

9. AWWA cyber
training

10. Who will
recognize the
threat next?

11. 1. Insurance companies

12. 2. Regulators

13. Flint: Lots of
people in legal
jeopardy
because they
didn't act on a
threat soon
enough.

14. Section 2

15. Utilities are
ideal targets
for two
reasons

16. Section 2A

17. Were you an
"essential worker"
in March 2020?

18. Water utilities
perform
essential
services

19. Reaching into
every home,
workplace,
church, school,
and clubhouse
in town

20. Any disruption
causes
distress

21. How long does it
take for residents
to notice a change
in color due to
hydrant flushing?

22. Even the power
company gets a
longer grace
period than the
water utility

23. Water service
requires
extreme trust

24. Aside from air,
it's the one
thing certain to
go into/onto
every body,
every day

25. Why do you
think customers
freak out about
any change in
color, taste, or
scent?

26. Take the
wackiest
responses to
fluoridation:
Shows how
much people
care

27. You don't get
a second
chance to
restore broken
trust

28. "Don't go back
to the
poisoned
well"

29. People let your staff and your
product into their homes

30. Section 2B

31. We had a leak

32. Water utilities
have sensitive
data on almost
everyone in a
community

33. It's not just
sensitive, it's
intimate

34. Obvious:
Payment data

35. Are you doing
enough to
meet
PCI/DSS?

36. You need to fear
ransomware

37. Less obvious
is what water
usage data
reveals

38. Who's home
alone?

39. Who's on
vacation?

40. Who's active
and who's
away at what
hours?

41. If the water
company knows
I have a leaky
toilet, what else
does it know?

42. If the sewage
department can test
for viruses, what
else can they test
for?

43. Section 3

44. Oldsmar,
Florida was
just the
beginning

45. Water utilities
do not have a
good track
record of taking
the threat
seriously

46. Getting lucky
isn't the same
as being smart

47. Targeting is
on the rise

48. You’re a “phish” on a spear

49. Only a matter of
time before we're
in the crosshairs

50. Section 4

51. Attacks on
Cedar Rapids,
Des Moines
schools

52. Schools are
the canaries in
the coal mine:
Utilities are
next

53. Cybersecurity
maintenance
requires
ongoing
attention

54. This isn't a
Ronco food
dehydrator.
No "set it and
forget it".

55. This needs to
become a
maintenance
priority

56. The
"connection of
everything" is
bound to grow

57. The more
convenient for
you, the more
exposed to
hackers

58. Section 5

59. Every
operator
needs
Chap-Stick
and hand
lotion

60. Without
regular skin
hygiene, bad
stuff can
break through

61. Good
cybersecurity
hygiene comes
from good
habits

62. Use
passphrases
where
possible

63. Length beats
classic
complexity

64. Don't store
passwords
where shoulder
surfers can see

65. Don't swap
USBs or plug
in
"discovered"
thumb drives

66. Go out-of-
band to check
on suspicious
attachments

67. Make sure 2FA
is activated
everywhere

68. Don't hang out
in sketchy
cyber-hoods

69. Section 6

70. Everyone is
annoyed by
password-
change
requirements

71. They're also
woefully
ineffective

72. And they give
a false
impression of
being "done"
with security

73. Cybersecurity
needs to be
treated as
ongoing,
periodic
maintenance

74. The threat
environment is
constantly
evolving

75. Like a crook
testing your
door every
night with a
new key

76. Hacking tools
are so easy a
child really
could use
them

77. Your only
option is to
keep
upgrading
the locks

78. Some of these
steps are like
changing the
oil

79. Section 7

80. You want to
stay out of the
headlines and
out of legal
jeopardy

81. Operators
need to do
seven things

82. Section 7A

83. You recognize
the Windows
Update
screen, of
course

84. Keep software
and firmware
up-to-date

85. Simplest
maintenance
you can do

86. Just click it

87. But whose job
is it to check
regularly?

88. IT?
Management?
Operations?
Maintenance?

89. Make a choice
and stick to it -
reportable and
accountable

90. Section 7B

91. What's your
best guess at
a Bluetooth
password?
→ 0-0-0-0

92. Replace
default
passwords

93. Every system
contains
devices with
default
passwords

94. Routers are a
major
vulnerability

95. But also: PLCs,
control panels,
operator
interfaces

96. A default
password is
like a skeleton
key

97. Section 7C

98. You'd get
suspicious if
you saw an
unmarked van
inside your
plant

99. Protect
networks from
unexpected
payloads

100. Least-
privilege
operation

101. Routine
training on
latest phishing
scams

102. Intrusion
detection tools

103. Obstacles to
unwanted
downloads

104. Section 7D

105. The Titanic had water-
tight compartments, but
they didn't go all the way
to the top of the ship

106. Secure and segregate devices
and data on all networks

107. Keep payment
data separate
from
operations
data

108. Keep as many
systems apart
as possible

109. Different "keys"
to unlock
different
functions

110. Section 7E

111. Recall the
school
ransomware
incidents

112. Encrypt
customer data

113. Scramble the
data that
others could
hold hostage

114. Good
encryption is
like shooting
the hostage

115. Just make sure
you have a
backup of
what you need

116. And if you don't
really need it,
don't keep it

117. Section 7F

118. You've surely noticed the uptick
in big, bad storms around here

119. Keep
offsite/non-
volatile
backups

120. Really critical
data should be
protected

121. Backup to
something
that can't get
fried by
lightning

122. Keep the
backup
somewhere
far from home

123. Section 7G

124. You don't
need TikTok to
run a SCADA
system

125. Practice good
habits on every
networked
device
(including
smartphones)

126. Hacking users
is the fastest
way into a
system

127. Consider only
allowing
tightly-
controlled
devices on
networks

128. Keep an eye
out for
malicious
apps

129. An endless loop of
expiring passwords
is actually harmful

130. Implement
long
passwords

131. Activate two-
factor
authentication

132. Purge what
you don't
need

133. Questions?
Thank you for your time and attention!
Brian Gongol
DJ Gongol & Associates, Inc.
515-223-4144
brian@gongol.net
@djgongol across social media

134. Sources
• All content in this presentation is
copyrighted by the author and duplication
or reuse is strictly forbidden without
express written consent
• Unless otherwise noted, all photographs
are the original work of the author
• NewYorkTribune,“1,340 Perish” headline
taken from
https://chroniclingamerica.loc.gov/lccn/sn83
030214/1912-04-16/ed-1/seq-1/