EPA Issues Cybersecurity Regulations for Public Water Systems: How Tenable Can Help
EPA released new regulations that require states to assess cybersecurity risks at drinking water systems and ensure these systems have sufficient cyber protections. Here’s what you need to know — and how Tenable can help.
The U.S. Environmental Protection Agency (EPA) issued a memorandum on March 3, 2023, directing states to include cybersecurity assessments when they conduct sanitation surveys, or audits, of public water systems (PWSs). This memorandum came one day after the release of the Biden administration’s National Cybersecurity Strategy, which called for the development of new cybersecurity requirements across critical infrastructure sectors. The EPA also released corresponding guidance, titled “Evaluating Cybersecurity During Public Water System Sanitary Surveys,” for how states and water utilities can evaluate and improve the cybersecurity of their systems.
When conducting a sanitary survey, which is “an onsite review of the water source, facilities, equipment, operation, and maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment, operation, and maintenance for producing and distributing safe drinking water,” states must now also do the following:
- If the PWS uses an industrial control system (ICS) or other operational technology (OT) as part of the equipment or operation of any required component of the sanitary survey, then the state must evaluate the adequacy of the cybersecurity of that OT for producing and distributing safe drinking water.
- If the state determines that a cybersecurity deficiency identified during a sanitary survey is significant, then the state must use its authority to require the PWS to address the significant deficiency.
The EPA guidance includes a checklist in its appendix A section, which is an optional tool states can utilize when conducting their sanitary surveys of a PWS’ cybersecurity protections. States can evaluate cybersecurity at a PWS through:
- self-assessments
- third-party assessments
- direct surveyor evaluations during sanitary surveys of a PWS
- their states’ current programs for assessing for cybersecurity gaps
Throughout this process, the EPA is offering technical support and training to assist states in addressing cybersecurity in their PWS sanitary surveys. More information can be found here.
How Tenable can help states meet the new EPA cybersecurity requirements
Here’s how Tenable can help PWSs meet the exposure management requirements included in the EPA’s guidance for states reviewing cybersecurity practices.1
| Checklist Category | Tenable Solution |
|---|---|
| Account Security (1.1-1.7) | 1.1, 1.2, 1.4 Tenable audits operating system (OS) configuration to ensure the control is active and will identify incorrect configuration via reports. |
| Device Security (2.1-2.5) |
2.2 Tenable audits OS configuration to ensure the control is active and will identify incorrect configuration via reports.
|
| Data Security (3.1-3.4) |
3.1 Tenable collects network traffic and creates logs for use in forensic investigations.
|
| Vulnerability Management (5.1-5.6) |
5.1 Tenable leverages domain expertise in industrial security for OT assets, and Nessus for IT assets. Tenable’s VPR scoring generates vulnerability and risk levels using each asset in your ICS network. Reports include detailed insights, along with mitigation suggestions. This enables authorized personnel to quickly identify the highest risk for priority remediation.
|
| Response and Recovery (7.1-7.4) | 7.4 Tenable maps the network and baselines its communications between all discovered devices aiding in the incident response (IR) process. |
__________________
1 This checklist does not include the categories that are related to policies versus products or technologies.
Learn more
- Webinar: The Constant Drip: EPA Water Regulations, Funding Sources, and How Tenable Can Help
- Tenable Blog: Navigating Recommendations for Public Water Utilities: How Tenable Can Help
- Protecting Public Water Systems from Cyber Attacks
- Tenable OT Security Solutions for Water Utilities
- Forrester Wave Report for Industrial Control Systems (ICS) Security Solutions
- City of Raleigh Case Study
- EPA Fact Sheet on Sanitary Surveys
- State and Local Cybersecurity Grant Program (SLCGP)
Related Articles
Cybersecurity Snapshot: New Report Ranks Top Cloud Threats, while CISA Guide Helps Assess Security of Software Products
August 9, 2024The Cloud Security Alliance has released its list of top cloud threats for 2024. Plus, CISA and the FBI published a guide for determining if a software product was built ‘secure by design.’ Meanwhile, find out how AI can transform offensive security. And get the latest on the Royal ransomware gang, the CIS Benchmarks and TikTok’s legal troubles!
Cybersecurity Snapshot: Data Breach Costs Rise, as Ransomware Attacks Fall, Reports Find
August 2, 2024IBM’s latest “Cost of a Data Breach Report” finds these data-theft incidents getting more expensive. Plus, the IT-ISAC says that ransomware attacks fell in Q2 due to law-enforcement disruptions of ransomware groups. Meanwhile, check out a Carnegie Mellon comp sci professor’s take on AI system security. And Tenable’s headed to Black Hat – visit our booth! And much more!
Cybersecurity Snapshot: North Korea’s Cyber Spies Hunt for Nuclear Secrets, as Online Criminals Ramp Up AI Use in the EU
July 26, 2024Check out a CISA-FBI advisory about North Korean cyber espionage on critical infrastructure orgs. Plus, what Europol found about the use of AI for cybercrime. Meanwhile, the risk concerns that healthcare leaders have about generative AI. And a poll on water plant cybersecurity. And much more!
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
- IT/OT
- Federal
- Government