# Advice Avalanche: Practical Steps for Wastewater Treatment Plants

- Link: https://www.agilicus.com/advice-avalanche-practical-steps-for-wastewater-treatment-plants/
- Published: 2024-09-27T02:05:36+00:00
- Author: Don Bowman

There has been an avalanche of advice, best practices on best practices for industrial
cyber security (e.g. [Fast, Simple, Secure: Implement CISA et al HMI (practically) recommends Agilicus AnyX](https://www.agilicus.com/fast-simple-secure-implement-cisa-et-al-hmi-practically-recommends-agilicus-anyx/),
[CISA: 8 Top Cyber Actions for Securing Water Systems](https://www.agilicus.com/cisa-8-top-cyber-actions-for-securing-water-systems/)).
This blog post summarises key takeaways from my recent [webinar](https://www.agilicus.com/webinars/cyber-alerts-best-practices-put-advice-to-action/)
on this topic, focusing on practical steps you can take to improve your plant’s 
security posture.

> [Cyber Alerts, Best Practices: Put Advice To Action](https://www.agilicus.com/webinars/cyber-alerts-best-practices-put-advice-to-action/)

**The Risks Are Real – and Growing**

We’ve all seen the headlines: the Kansas City freshwater plant shutdown, the Muleshoe,
Texas water tank overflow (we even posted the video of the [HMI](https://www.agilicus.com/inbound-hmi-cyber-army-of-russia-targeting-us-water-facilities/)
hack on our website!), and the infamous Oldsmar, Florida incident. These aren’t 
isolated incidents; they’re the tip of the iceberg. For every publicly reported 
attack, there are likely many more going unreported. Nation-state actors aren’t 
just after a quick ransom; they want persistent access for future exploitation. 
This makes even undetected vulnerabilities a serious concern.

**Deciphering the Avalanche of Advice**

The constant stream of alerts from CISA, the DOJ, the FBI, and other agencies can
be overwhelming. They often call for immediate and sweeping changes that may be 
difficult, if not impossible, to implement. Many of these directives, while well-
intentioned, lack the practical context needed for implementation in industrial 
settings. For example, the blanket call to remove all VPNs from networks is unrealistic
for many plants. These advisories need to be translated into concrete action items.

**Evergreen Tactics: Simple, Effective Security**

Let’s focus on practical, cost-effective measures, regardless of the specific attack
vector:

 * **Stronger Identities, Not Shared Passwords:** The number one problem? Default
   passwords and shared accounts. A recent CISA report revealed that 94.4% of US
   Coast Guard entities had at least one default password. This is a disaster waiting
   to happen. The solution? Move to single sign-on (SSO) and multi-factor authentication(
   MFA) across all your systems. We recommend focusing on the HMI first, as it’s
   the most human-facing element. An identity-aware proxy can make even legacy systems
   secure by handling authentication separately. This eliminates guessable passwords,
   accounts that never change, and simplifies access for employees and third parties.
 * **Defence in Depth – Beyond the Air Gap:** The “air gap” is porous. USB drives,
   cellular modems, and remote support tools all represent potential entry points.
   Defence in depth requires multiple layers of security. Network segmentation, 
   robust backups (offsite and protected from flooding!), and well-defined incident
   response plans are crucial. Understand what you have through thorough inventory
   and regular security assessments.
 * **Zero Trust is a Principle, Not a Product:** Zero trust isn’t a magic bullet;
   it’s a philosophy centered around three things: _Who_ (identity – strong authentication
   of individual users), _What_ (authorisation – defining what each user can access),
   and _How_ (secure access methods). If you have those three components, you’re
   well on your way to a zero-trust architecture.
 * **Addressing the Moral Hazard:** Your vendors and partners may prioritise simplicity
   over security, pushing for shared credentials. This creates a moral hazard; you
   bear the risk, they enjoy the ease of access. SSO and MFA align these interests;
   it’s simpler for your partners and significantly more secure for your plant.

**Moving Beyond the “Avalanche” – Practical Steps**

The government’s eight key recommendations for securing water systems boil down 
to:

 1. **Reduce** Exposure to the Public-Facing Internet
 2. **Conduct** Regular Cybersecurity Assessments
 3. **Change** Default Passwords Immediately
 4. Conduct an **Inventory** of Operational Technology/Information Technology Assets
 5. **Develop** and Exercise Cybersecurity Incident Response and Recovery Plans
 6. **Backup** Operational Technology **AND** Information Technology Systems
 7. **Reduce Exposure** to Vulnerabilities
 8. Conduct Cyber security Awareness **Training**

Remember, you don’t have to be better than a nation-state actor; you just need to
be better than your neighbours.

**Conclusion: Security as an Enabler**

The world has changed. Remote access is now essential for efficiency and responsiveness.
Security doesn’t need to be a barrier; it can be an enabler. By implementing these
practical steps, you can significantly reduce your risk while maintaining operational
efficiency. Contact us at Agilicus to learn more about how our solutions can help
you secure your wastewater treatment plant.