Firewalls are not a sufficient security solution for protecting water and wastewater facility SCADA systems from cyberattacks, according to Lior Frenkel, CEO of Waterfall Security Solutions. The primary sources of cyber risk are wide-area networks (WANs) used for remote monitoring, and firewalls connected to those networks remain insufficient barriers against targeted attacks.
Why Are Water Facilities Vulnerable to Cyberattacks?
Water and wastewater facilities face cyber risk primarily through two wide-area-network connections: one linking the corporate network and internet, and one connecting remote pumping stations and sensors. Firewalls have traditionally protected these WAN connections, but Lior Frenkel of Waterfall Security Solutions states that firewalls are not a strong enough security solution to prevent cyberattacks from entering water facilities’ control systems.
What Damage Can a Cyberattack on Water Cause?
A cyberattack on a water facility’s industrial controls could allow a remote hacker to increase the level of chemicals in the water supply, causing serious damage to public health. Detection systems at water plants can take weeks or months to identify such a breach. This detection lag is precisely why SCADA systems require a different cybersecurity approach than traditional IT-based solutions.
We need to protect people’s safety, and the reliability of the water plant. First and foremost, we need a solution that prevent attacks from entering the control system, not just stopping from propagating or detecting them after the fact. Anything less than prevention will be too little, too late.
Firewalls vs. Unidirectional Gateways: Which Protects SCADA?
Prevention of remote cyberattacks, rather than detection or containment after the fact, is the required standard for water facility SCADA security. Waterfall Security Solutions provides a solution that creates a physical impasse preventing the flow of communications from entering a SCADA control system, while still allowing authorized users to access externally replicated real-time operating data on corporate IT networks.
It is encouraging to see more and more water & wastewater facilities fortifying their SCADA networks with cyber security technology that actually works. Firewalls are not the solution to protect the ICS perimeter from the Internet, and the issue is too important to neglect.
The article was written by Lior Frenkel and originally was published here. Edited by C. Rudinschi.
Lior Frenkel is the CEO and co-founder of Waterfall Security Solutions, a leading provider of unidirectional security gateways, stronger-than-firewalls perimeter security solutions for industrial control networks and critical infrastructures.
