US CISA Must Improve Water Sector Assistance, Says Watchdog

A U.S. federal watchdog said government agencies could better synchronize efforts to improve water and wastewater sector cybersecurity efforts and faulted the Cybersecurity and Infrastructure Security Agency for not coordinating well with the Environmental Protection Agency.

See Also: Live Webinar | Integrating Splunk and Panther for Real-Time Alerting and Custom Dashboarding

A report from the Department of Homeland Security Office of Inspector General shows a lack of communication between the two agencies. “CISA officials acknowledged the need to improve its collaboration with EPA and produce better products for the water sector,” the report states. CISA is a DHS component.

Water and wastewater is one of the 16 U.S. critical infrastructure sectors, but it is operated mainly by municipal and county governments. Funding shortfalls often translate into aging IT infrastructure and poor cybersecurity or staff unprepared to handle the risks of newer equipment with human-machine interfaces that remotely connect operators to water control systems.

The Biden administration last year attempted to make cybersecurity a component of federally mandated safety assessments of water systems, but it backed down after federal judges sided with state attorneys general who asserted that the EPA lacked authority to force the issue (see: US EPA Nixes Cybersecurity Assessments of Water Systems).

Worries that hackers could tamper with drinking water gained urgency after city officials in Oldsmar, Florida, in 2021 apparently stopped an attacker from mixing dangerous levels of lye into municipal pipes – although municipal officials stressed at the time that fail-safe mechanisms would have ensured the unsafe water never made it into tap water. An Oldsmar official has since reportedly cast doubt on whether the incident was a cyberattack, stating that it actually was a case of employee error.

There are approximately 50,000 community water systems in the United States and more than 16,000 publicly owned wastewater treatment systems.

The OIG recommended that CISA develop a memorandum of understanding with the EPA that documents the roles of each respective agency and establishes mechanisms for collaboration. Auditors said not every part of CISA knew when another part had interfaced with the EPA, leading to ineffective internal coordination. CISA pledged to complete the memorandum by Oct. 31.

The OIG also said that CISA could develop policies for collaboration with the water sector coordinating council – the public-private body meant to act as a middleman between each critical infrastructure sector and its government counterpart.

One water council member told auditors that their concerns don’t always reach CISA and that water systems didn’t always have a good understanding of CISA’s products and services. Water officials also want more say in how CISA develops water system assistance and told auditors that by the time they’re consulted, it’s often too late to effect any changes. That has resulted in “CISA products and services that only partially met the needs of the water sector or were not user-friendly,” they said.

CISA pledged to follow up its memorandum with the EPA by shoring up policies for engagement with the agency and with the council.