Cybersecurity

On March 18, 2024, the White House issued a press release addressed to governors nationwide, alerting them to a critical security threat facing water and wastewater systems in the U.S.. The communication highlighted that water systems, both large and small, are being targeted by foreign entities with malicious intent. The threat actors are actively seeking various avenues to gain unauthorized access to sensitive data files and records.

These attacks pose a significant risk of disrupting the essential services provided by water systems, potentially jeopardizing the supply of clean and safe drinking water. Moreover, they can impose substantial financial costs on affected communities. To raise awareness and understanding of this risk, we are providing descriptions of these threats and to seek your partnership in taking action to safeguard water systems and the communities they serve.

In response to these escalating threats, the Department of Environmental Quality (DEQ) is creating a Utah Public Water and Wastewater System Cybersecurity Plan. The objective of this plan is to assist all public drinking water and wastewater systems in immediate response, investigation, and isolation of cyberattacks by connecting them with top State and Federal cybersecurity experts and providing technical support during the incident.

Our goal is to promote statewide preparedness and provide support for responding to and recovering from any cyber incidents that may arise.

Utah Public Water and Wastewater System Cybersecurity Plan

The Utah Department of Environmental Quality (DEQ) has developed a Utah Public Water and Wastewater System Cybersecurity Plan. This plan provides immediate response, investigation, and isolation support for cyberattacks, connecting systems with State and Federal cybersecurity experts. The goal is to enhance statewide preparedness and support recovery from cyber incidents.

We encourage all stakeholders to review these materials and integrate the recommended practices into their cybersecurity strategies. Protecting our water and wastewater systems from cyber threats is crucial to maintaining the safety and reliability of our services.

• Cybersecurity Plan

Public Water System Notification Requirements

If a public water system suspects a cyberattack, it is imperative that they promptly initiate incident response measures. Security failures within water system technology could have cascading impacts across critical infrastructure. Responding immediately and effectively to a cyberattack is essential for minimizing potential damage to water systems.

Resources

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA) websites offer guidance, tools, training, resources, and technical assistance for water systems.

Contacts