Rural water systems at risk of cyberattacks, advocates say

State and local infrastructure advocates told a Senate panel that rural water utilities may be vulnerable to cyberattacks because they're understaffed and employees need more training on federal cybersecurity regulations. Cyberattacks are a rising threat for utilities and the nation's food supply chain.

During a July 21 Environment and Public Works Committee hearing, advocates urged senators to better fund technical training and assistance programs like the Rural Water Circuit Rider Program. "The initiative was launched in 1980 with the goal of providing hands-on federal training and technical assistance to water utility managers and other specialists on a range of issues, including compliance with federal regulations and all other aspects of water utility management," Chris Riotta reports for government information technology publication GCN. Sophia Oberton of the Delmar Public Works Department in Maryland testified that the program is underutilized among rural communities, but could provide critical training and assistance.

"Other witnesses also stressed the need for further training and funding to meet the cybersecurity goals featured in President Joe Biden's cybersecurity executive order released in May, which outlined aggressive deadlines for all agencies and stakeholders to begin improving their cyber posture," Riotta reports. "A majority of water utilities, however, have not even fully assessed their own IT assets, according to a June survey from the Water Information Sharing and Analysis Center that included responses from more than 530 organizations. Dozens of firms responded that they were 'not sure' if they had experienced a cyber incident."

Some water utilities, private contractors and federal agencies have successfully responded to cyberattacks after implementing the National Institute of Standards and Technology's cybersecurity framework, according to Shailen Bhatt, president and CEO of the Intelligent Transportation Society of America. He recommended during the hearing that all stakeholders adopt the framework, which he says helps identify systemic threats, protect against vulnerabilities, detect and respond to attacks, and recover, Riotta reports.