After recent water utility hacks, how secure is Arizona?

A swath of cyberattacks on U.S. water infrastructure in recent weeks raises the question: Could something like that happen here in Arizona?

In late July, wastewater utilities in at least seven states reported coordinated breaches targeting programmable logic controllers — the brains of the computers — that are connected to pumps, valves and pressure systems.

A cybersecurity expert at Arizona State University explained why this critical resource is a strategic target for foreign adversaries.

“They are definitely one of the most attractive resources we have. They are used in agriculture, they are used in our daily lives, they are used in data centers,” Muslum Ozgur Ozmen, an assistant professor at the School of Computing and Augmented Intelligence at ASU, told KTAR News 92.3 FM.

Water systems across the U.S. are decentralized, meaning each municipality is in control of its own water infrastructure.

“It’s not only stealing your information, but contaminating your water, making your water system unavailable. It becomes much more important,” Ozmen said.

These are cyber-physical systems, meaning they combine internet-connected computer controls with physical equipment such as sensors and actuators that interact directly with the real world.

Hackers look for vulnerabilities

Hackers can scan the system and look for vulnerabilities, such as an internet connection or weak passwords.

“There were some default passwords being used, so weak passwords being used. … The attackers were able to get into these specific plants,” Ozmen said.

However, he said artificial intelligence models can be used to:

• Identify vulnerabilities and patch them before the attackers can target them.
• Allow wastewater treatment operators to remotely monitor these locations.
• Give managers the ability to monitor abnormal behavior if an attack is ongoing so cybersecurity defenses can quickly intervene.

Best cybersecurity practices can prevent an attack

In these most recent attacks, hackers went after smaller municipalities.

“Some smaller municipalities may have less resources to follow these best cybersecurity practices,” Ozmen said.

He said a cyberattack on Arizona’s water infrastructure is unlikely because the Phoenix metro area has more resources for cybersecurity.

“In the Phoenix area, I would say it’s very difficult. I’m pretty sure our officials ensure they are following the best cybersecurity practices,” Ozmen said.

Related

Lake Powell hits record low, threatening key water and electricity supply for millionsArizona’s tribal, rural communities will bear the brunt as Colorado River plan fails to stabilizeArizona congressman warns that unfair Colorado River cuts in his state will harm USAs the Grand Canyon’s river is drying up a $50 million industry is going with itCentral Arizona Project president says feds ‘bought the lies’ on Colorado River planGov. Katie Hobbs pushes back on ‘unacceptable’ terms in federal Colorado River proposal