The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a surge in cyberattacks targeting internet-connected programmable logic controllers (PLCs) used by water and wastewater facilities This article explores cybersecurity infrastructure security. . These industrial devices manage critical processes like treatment, pumping, chemical dosing, and wastewater management.
When these systems are accessible via the internet, attackers can manipulate their configurations, disrupt operations, or isolate authorized personnel from essential equipment. CISA revealed that threat actors have exploited vulnerabilities in smaller entities with established cybersecurity protocols as well as larger facilities. While manual operation can help during an incident, it puts staff under increased pressure and poses safety risks if the disruptions persist.
Remote access should not connect directly to a PLC; instead, organizations should use a properly secured virtual private network (VPN) or a gateway device that provides authentication, monitoring, and access control. CISA specifically advised Rockwell Automation MicroLogix 1400 PLC users to consult their guidance on restoring access when the controller password is unknown. Devices connected to the internet face risks such as website-style defacement and unauthorized configuration changes, service disruptions, and potential physical damage.
Utilities should thoroughly review all external connections, including undocumented vendor-installed cellular equipment, ensuring no critical Programmable Logic Controllers (PLCs) are directly exposed to the public internet. Enhance your Security Operations Center (SOC) with faster threat detection and swift investigations.
