Lessons Learned from Oldsmar Water Plant Hack

Lessons Learned from Oldsmar Water Plant Hack

Cybersecurity experts have long warned of attacks on small municipal systems. Until hackers accessed the water treatment plant of a small Florida city this year, those warnings were “out of sight, out of mind.” Now, both local and national authorities’ perspectives on the dangers of cybersecurity attacks are changing.

The intrusion only lasted between three and five minutes, according to the Tampa Bay Times. In that time, the level of sodium hydroxide being fed to the city of Oldsmar, Florida—home to 15,000 people—was changed from 100 parts per million to 11,100 parts per million. It took five and a half hours for an employee to notice the change.

“This is dangerous stuff,” Pinellas County Sheriff Bob Gualtieri said at a news conference. Consumed in large quantities, sodium hydroxide can cause vomiting, chest and abdominal pain, skin burns, even hair loss, according to the Centers for Disease Control.

Florida Senator Marco Rubio addressed the attack on Twitter, calling it a “matter of national security.”

Why This Matters
This scenario is an example of how a critical infrastructure intrusion at any level puts residents’ lives at risk. Eric Chien, a security researcher at Symantec, described the Oldsmar city water plant as exactly the kind of utility security professionals need to worry about.

“This is a small municipality that is likely small-budgeted and under-resourced, which purposely set up remote access so employees and outside contractors can remote in,” Chien told The New York Times. He described it further as a ripe target.

Cybersecurity breaches can have catastrophic effects on any sized municipal entities, making protection against cyber threats, compliance, and responsible data management more important now than ever.

Critical Next Steps
Luckily, raised awareness around the importance of cybersecurity has also generated strategies for preventing these same kinds of events from being repeated. Today, security professionals can prepare their municipalities for all cyber threats by following these best practices:

Segment Operational Technology (OT) away from Information Technology (IT). While OT networks control elements in the physical world, IT systems manage crucial data networks. This means, separating the two means protecting OT devices from any possible digital breach.

Be aware of any remote access software (such as TeamViewer) in your environment. These programs may reduce the need for employees on site and streamline access, from anywhere in the world. Remote access software is also the most vulnerable to cybersecurity breaches.

Mitigate potential security breaches through apps, using strong passwords, two-factor authentication strategies, and by whitelisting (i.e., only allowing authorized sites access to your IT networks).

Make sure there is always a third-party continuously monitoring for any incidents. Just as important as cyber hardness is the ability to step in and mitigate the effects of breaches in real-time.

Conclusion
The event in Oldsmar, Florida, this year was an isolated event. Hackers remotely accessed a small town’s water treatment plant and tried to poison the water supply. Local authorities were able to intervene, before any serious damage was done. But this doesn’t mean similar entities in other cities are off the hook.

Cyberattacks have the potential to put thousands of lives in danger—make sure you are implementing smart, sustainable strategies to prevent this from happening to you.

About the Author

Jeremy Rasmussen is chief technology officer at Abacode.

Featured

  • Cyber Overconfidence Is Leaving Your Organization Vulnerable

    The increased sophistication of cyber threats pumped by the relentless use of AI and machine learning brings forth record-breaking statistics. Cyberattacks grew 44% YoY in 2024, with a weekly average of 1,673 cyberattacks per organization. While organizations up their security game to help thwart these attacks, a critical question remains: Can employees identify a threat when they come across one? A Confidence Gap survey reveals that 86% of employees feel confident in their ability to identify phishing attempts. But things are not as rosy as they appear; the more significant part of the report finds this confidence misplaced. Read Now

  • Mission 500 Debuts Refreshed Identity Ahead of Security 5K/2K at ISC West

    Mission 500, the security industry’s nonprofit charity dedicated to supporting children in need across the US, Canada, and Puerto Rico, has unveiled a refreshed brand identity ahead of ISC West. The charity’s new look includes a modernized logo with refined messaging to reinforce Mission 500’s nearly decade-long commitment to serving the needs of children and families in crisis. Read Now

    • Industry Events
  • Meeting Modern Demands

    Door hardware and access control continue to be at the forefront of innovation within the security industry, continuously evolving to meet the dynamic needs of commercial spaces. Read Now

  • Leveraging IoT and Open Platform VMS for a Connected Future

    The evolution of urban environments is being reshaped by the convergence of Internet of Things (IoT) technology and open platform VMS. As cities worldwide grapple with growing populations and increasing operational complexities, these integrated technologies are emerging as powerful tools for creating more livable, efficient, and secure urban spaces. Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.