Cyber threats targeting critical infrastructure are no longer limited to energy networks or financial networks. The cybersecurity of water systems has become an increasingly significant concern for governments worldwide, as drinking water and wastewater systems rely more and more on digital technologies.
See also: Operation Synergia III: INTERPOL dismantles digital criminal networks
Responding to these growing risks, New York Governor Kathy Hochul this week announced a set of new cybersecurity regulations and a $2.5 million grant program aimed at helping communities protect their drinking water and wastewater systems from cyberattacks.
This initiative represents what government officials describe as a holistic approach by the government to the cybersecurity of water systems, combining regulatory standards, financial support, and technical assistance to strengthen the security of critical services used by millions of New Yorkers.
Water systems were traditionally considered a matter of physical infrastructure. But as treatment facilities and distribution systems rely increasingly on internet‑connected control systems and digital monitoring systems, the cybersecurity of water systems has become a major issue.
Modern wastewater treatment facilities and drinking water plants use digital systems to monitor chemical balances, control pumps, manage filtration processes, and coordinate distribution networks. While these technologies improve efficiency, they also introduce potential cyber threats.
State officials warn that cyber attacks targeting water infrastructure could disrupt essential services or affect systems that protect public health. As digital infrastructure expands into critical services, improving the cybersecurity of water systems is becoming equally important as maintaining physical infrastructure.
See also: Velvet Tempest: Distribution of DonutLoader and CastleRAT via ClickFix techniques
To address these challenges, the New York Department of Environmental Conservation and the New York Department of Health have jointly developed new cybersecurity standards for water infrastructure across the state.
The regulations set minimum security requirements designed to strengthen the cybersecurity of the water infrastructure while remaining practical for local operators. Key measures include:
- Mandatory cybersecurity training for certified operators
- Cybersecurity incident reporting requirements
- Risk-based standards, with protection levels for critical functions and sensitive information
- Definition of a responsible cybersecurity role in larger drinking water systems
These measures aim to advance water infrastructure towards a more structured approach to cybersecurity, ensuring that operators have both the knowledge and the responsibility required to respond to emerging threats.
In addition to the regulatory framework, the state is introducing financial support to help communities implement cybersecurity improvements. The Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE), administered by the New York State Environmental Facilities Corporation, will provide $2.5 million in funding to support cybersecurity projects at local water and wastewater facilities.
In addition to funding, the Environmental Facilities Corporation will provide free technical assistance through Community Assistance Teams, helping agencies implement cybersecurity best practices and navigate grant applications.
See also: FBI investigation into breach of surveillance systems
State officials believe that the combination of regulations with funding will make improvements to water systems cybersecurity more realistic for smaller communities with limited resources.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
