Vulnerable Systems: Why America’s Water Infrastructure is Still Unprepared for Cyberattacks

The recent wave of cyberattacks on municipal water facilities across at least a dozen states has raised serious questions about the federal government’s ability to protect its most critical infrastructure. The attacks, while seemingly inconsequential in terms of contaminated water, have highlighted the vulnerability of our nation’s water systems and underscored the urgent need for a more robust defense strategy.

The coordinated assault on America’s water supply mirrors a disturbing trend of increasing cyber threats against critical infrastructure. In 2023, the Iranian-backed CyberAv3ngers group breached water utility controllers in Aliquippa, Pennsylvania, using only default factory passwords. The incident prompted CISA to issue an advisory with remedial steps that read like a basic cybersecurity primer: implement multifactor authentication, use strong unique passwords, and check Programmable Logic Controllers for default or no passwords.

The fact that this advice went unfollowed in many quarters raises questions about the effectiveness of CISA’s response. The agency, tasked with leading the nation’s collective defense against cyber threats, appears woefully unprepared to meet the moment. With a reduced budget and staffing, CISA is struggling to keep pace with the evolving threat landscape.

Tatyana Bolton, executive director at the Operational Technology Cybersecurity Coalition, notes that an absence of baseline controls and standards in the water infrastructure sector is a major contributor to vulnerability. However, she also acknowledges that CISA’s chronic underfunding and spread-too-thin mandate are significant hurdles.

The decentralized nature of America’s water system presents particular security challenges. With approximately 148,000 public water systems across the country, each with its own operational technologies, it’s a fragmented landscape that hackers can exploit. Iran has demonstrated its ability to target individual water systems, as seen in previous attacks.

Economic disparities between larger cities and smaller communities exacerbate the problem. Roughly 85 percent of water systems serve communities of fewer than 50,000 people, yet these communities comprise less than 10 percent of the entire U.S. population. This disparity means that many smaller communities lack dedicated OT security staff and redundant control systems.

The House bill H.R. 7922, introduced in 2024 by Reps. Rick Crawford and John Duarte, aims to create an independent organization to address water risk and resilience challenges facing America’s water infrastructure. While a step in the right direction, this legislation is just one piece of a larger puzzle that requires a holistic solution.

The recent attacks on our water supply serve as a stark reminder of the consequences of complacency. As we continue to rely on outdated systems and inadequate security measures, we put ourselves at risk for catastrophic failures. It’s time for the federal government to take a more proactive approach to protecting America’s critical infrastructure. A comprehensive plan that addresses vulnerabilities in our water system is needed, one that prioritizes funding and resources for CISA and invests in the development of baseline controls and standards.

Until then, we’ll continue to play catch-up with each new cyber threat, leaving ourselves vulnerable to hostile foreign actors. The stakes are too high to wait any longer.