Two to four hours. That’s how long a hospital can operate if its water supply is cut off. Water is life. Its absence means delayed care, degraded care, increased morbidity, and even increased mortality. Delivery of clean water is a life-safety critical function. When water delivery is interrupted, it has immediate impacts on public health and safety. It is therefore a core government responsibility to ensure that the more than 50,000 community water systems across the United States can continue to operate.
Unfortunately, water delivery, like other life-safety critical functions, is increasingly at risk. Hackers affiliated with the Iranian government have accessed utilities across the country, executing malicious commands on their systems and forcing facilities to temporarily shut down. These recent incidents have exposed what cybersecurity experts have long known: our society is built on fragile foundations.
How fragile? Consider that, in many cases, the programmable logic controllers (PLCs) that hackers are targeting have functionally unpatchable security flaws. In traditional cybersecurity circles, we worry about how to bring down patching times and prioritize remediation. However, when the machines are controlling not just sensitive data, but the physical processes that undergird our very society, patching is not even an option. All a malicious actor needs to do is find one of these devices exposed online, and they can take control.
