From: Infosecurity-Magazine
EPA opts out of further regulation to protect critical infrastructure.
As the recent e. Coli scare in Portland, Ore., indicates, access to clean drinking water is a basic necessity for avoiding disease and allowing society to function unhindered by the need to, say, boil one’s bathwater for at least one minute every evening. The US Environmental Protection Agency (EPA) is now striving to implement the Cybersecurity Framework as part of a public-private effort to lock down the systems in the water and wastewater systems sector.
The stakes are of course massive: the sector comprises approximately 155,000 public water systems that serve drinking water to more than 300 million people, and approximately 16,500 publicly owned treatment works that treat wastewater from more than 227 million people and certain industrial facilities. The EPA is tasked with ensuring these works provide drinking water that meets all applicable state and federal regulations in sufficient quantity to serve all customers with an uninterrupted supply and at sufficient pressures and flows for fire suppression; and with making sure that wastewater is transported to a facility where it is treated to meet all local, state and federal standards prior to discharge to the environment.
For decades, water and wastewater facilities have used industrial control systems and electronic networks to varying degrees to monitor and control surface-water intakes, groundwater wells, sewage collection, water and sewage treatment, distribution systems, effluent discharge and other processes. That in turn makes for a large attack surface for cyber-terrorists.
Leave a Reply