The Oldsmar Water System Attack: What It Can Teach Us

The Oldsmar Water System Attack: What It Can Teach Us

Last week’s attack on the Oldsmar, Florida, water system demonstrated that critical infrastructure operations are under constant threat of cyber attacks, and that a successful attack can have life-threatening consequences.

Fortunately, the Oldsmar breach was detected and addressed before any harm was done. And while it may be months before we have all the details of this particular attack, it serves as a reminder of realities that every critical infrastructure organization must confront.

It can happen anywhere

There’s nothing about a water treatment facility in Oldsmar, Florida that would make it an obvious target for an attack, but that’s the point. Threat actors don’t limit their attacks to large, high-profile targets. Smaller organizations—with less money to spend on cybersecurity—are ideal for testing out or demonstrating new attack techniques.

And as a reminder, attackers don’t need to single out their victims in advance—they let automated tools run in the background, searching for user credentials (or other vulnerabilities) at thousands of organizations at once. Once they find a vulnerable network, they can choose their moment to exploit it, or sell access to other threat actors.

Connectivity creates risk

Remote access and internet connectivity have become facts of life for many critical infrastructure organizations, especially during the pandemic. But new network connections create new possibilities for a security breach.

Government cybersecurity experts and standards bodies have been proposing for years strategies and techniques to limit exposure and prevent breaches at facilities like Oldsmar. These are outlined in the Department of Homeland Security’s publication Seven Steps to Effectively Defend Industrial Control Systems, and in the IEC 62443 standards for security in industrial communication networks. These publications recommend a defense-in-depth strategy, based on network segmentation and use of tightly controlled data flows into and out of plants, for managing the growing risks to critical infrastructure.

Owl Cyber Defense has helped water systems adopt these strategies and gain greater control over their data flows using data diode technology. To learn more about the DHS Seven Steps to Effectively Defend Industrial Control Systems and how Owl can help implement them, read our whitepaper Owl Supports DHS 7 Strategies.

Insights to your Inbox

Stay informed with the latest cybersecurity news and resources.

Paul Nguyen DoD Account Director

Proven Solutions for Navy “Data Maneuverability” @ AFCEA WEST

Hi, I’m Paul Nguyen, one of the new leaders of Owl’s DoD Mission Support team. I joined Owl Cyber Defense (Owl) earlier this month, just in time to be a part of our annual corporate o...
January 31, 2024

Owl SEER Lab MiniBlog 1: CVE-2023-21093

Hello and welcome to the launch of the Owl Cyber Defense System Evaluation, Exploitation, and Research (SEER) Laboratory miniblog! This is the very first in a line of forthcoming posts. ...
September 26, 2023

Reduce Cyber Stress (at least at work) by Implementing Data Diode Enforced Segmentation

In today's digital age, cybersecurity professionals play a crucial role in ensuring the safety and security of an organization's sensitive information. With the rise of cyberattacks, it's...
April 20, 2023