Urgent Advisory: Securing Internet-Exposed HMIs in Water and Wastewater Facilities to Protect Critical Infrastructure

Water Systems Under Cybersecurity Alert: Experts Warn of Risks from Internet-Exposed Interfaces

In a stark warning issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA), the security of water and wastewater systems is under scrutiny as internet-exposed human-machine interfaces (HMIs) pose significant cybersecurity risks. The advisory emphasizes that vulnerable HMIs could allow malicious actors to infiltrate industrial control systems (ICS), potentially leading to disastrous outcomes such as setting alterations, alarm disablement, and unauthorized access.

Security experts share alarming insights on this threat. Casey Ellis, Founder at Bugcrowd, stresses that safety-critical systems, particularly those managing our water resources, should never be accessible online. He points to the pandemic as a catalyst for poor security decisions when remote work shifted operational protocols, leading to critical systems being left vulnerable. "These systems should always be firewalled off from public access," he warns, highlighting the deep implications of negligent security measures.

Venky Raju, Field CTO at ColorTokens, echoes these concerns, noting the direct access HMIs provide to operators managing distributed water facilities. With many municipal organizations constrained by limited budgets, internet accessibility becomes a troubling shortcut that can result in serious public health risks. Raju advocates for the implementation of VPNs or zero trust network access solutions to ensure secure remote access.

Eric Schwake, Director of Cybersecurity Strategy at Salt Security, adds a chilling perspective, emphasizing that the exposure of HMIs can serve as gateways for cybercriminals to manipulate water supply and potentially cause contamination or physical damage. He advocates for a comprehensive approach to securing all components of critical infrastructure, specifically highlighting the need for robust API security.

As experts stress the urgency of safeguarding our water systems, this advisory serves as a critical reminder that cybersecurity is not just a technical concern, but a vital component of public health and safety.