Cyber Intrusion at Florida Water Treatment Plant

Summary

On February 5, 2021, an unauthorized individual gained access to the network of a small water treatment plant in Florida. According to reports, the user connected to the network via the remote access software TeamViewer and modified controls in order to increase the amount of sodium hydroxide – known as lye – from 100 parts per million (ppm) to 11,110 ppm. A plant operator noticed the unauthorized access and returned the levels to normal before any tainted water made its way to the servicing population. Authorities revealed that the plant’s operational technology (OT) network was externally accessible; however, additional details have not been disclosed at the time of this writing. The FBI and Secret Service are investigating. Incidents such as this highlight the cyber risk to critical infrastructure systems, including those in New Jersey, and the importance of implementing best practices.

Recommendations

The NJCCIC recommends critical infrastructure facilities apply cybersecurity best practices, including segmenting OT systems and networks from the internet, implementing IP whitelisting and VPN use for remote access to IT networks, keeping hardware and software up to date, and enabling multi-factor authentication for system and network access. More information about the recent cyber incident at the Oldsmar, Florida water treatment plant can be found in the Wired article and best practices for industrial control system (ICS) can be found in the CISA Cybersecurity Practices publication.