The assault on command and control systems at Israeli water infrastructure facilities was thwarted. In the aftermath of the attack, experts have called for greater efforts to secure the sector
A recent cyberattack against Israel's water supply and treatment sector has refocused attention on the importance of ensuring the cyber security of such critical infrastructure.
The Israel National Cyber Directorate (INCD) issued an alert late last week saying it received reports of attempted attacks on supervisory control and data acquisition systems at pumping stations, sewage facilities and wastewater treatment plants.
The INCD urged companies and entities in the energy and water sectors to immediately exchange passwords of internet-accessible control systems, reduce internet exposure and ensure that the most up-to-date version of control system software is installed. Companies were also told to take systems offline if the passwords could not be changed.
The attacks on command and control systems were said to have taken place on April 24 and 25 at facilities around the country.
In a statement, Israel's Water Authority confirmed the attacks but said the water supply system was not affected and continues to operate normally.
Reports said the authority urged companies to report any disruption in operations, particularly chlorine control systems.
Meanwhile, the cyber incident has sparked new calls to secure the sector.
"This attempted attack highlights that while water infrastructure often eludes the public's attention as a major source of cyber-risk, it remains susceptible to both targeted and non-targeted threats," said Dave Weinstein, CSO at US cyber security firm Claroty.
Stuart Reed, VP cyber at UK-based cyber security company Nominet, commented that "While only limited details about the attack have been revealed, the alert comes from the Israeli government and does demonstrate well-coordinated communication during their incident response process."
"By incorporating these types of processes, with sophisticated technology that can act fast and protect the breadth of a network, combined with a workforce that is increasingly aware of the cyber risks, governments around the world can work towards a much more resilient cyber posture."
