Please%20read%20the%20text%20carefully.%20Identify%20the%20main%20topic%20and%20key%20points%20covered%20in%20the%20text.%20%0AWrite%20a%20concise%20summary%20of%20the%20text%20in%20exactly%203%20bullets%20in%20markdown,%20focusing%20solely%20on%20the%20main%20topic%20and%20key%20points%20you%20identified.%20Your%20output%20should%20contain%20only%20the%20summary%20text%20itself.%20Do%20not%20include%20any%20explanations,%20introduction,%20or%20other%20extraneous%20text%20like%20%22%20Here%20is%20a%20concise%20summary...%22.%20The%20summary%20should%20be%20able%20to%20stand%20alone.%20%0AHere%20is%20the%20text%20to%20summarize:%0A%3Ctext%3E%0A.HeaderLogo_svg__cls-3%7Bfill:gray%7D%0A%0ACISO%20Stories%0ATopics%0ATopic%20Hubs%0AEvents%0APodcasts%0AResearch%0ARecognition%0AAbout%0A%0A%0A%0A%0A%0A%0ACritical%20Infrastructure%20Security%0ADrinking%20water%20systems%20for%2026M%20Americans%20face%20high%20cybersecurity%20risks%0ANovember%2015,%202024%0AShare%0A%0ABy%20Steve%20Zurier%0A%0A(Adobe%20Stock)%0AThe%20Environmental%20Protection%20Agency%E2%80%99s%20(EPAs)%20Office%20of%20Inspector%20General%20(OIG)%20on%20Nov.%2013%20reported%20that%2097%20drinking%20water%20systems%20serving%20about%2026.6%20million%20Americans%20around%20the%20country%20have%20either%20%E2%80%9Ccritical%20or%20high-risk%E2%80%9D%20cybersecurity%20vulnerabilities.%0AWhile%20attempting%20to%20notify%20the%20EPA%20about%20the%20cybersecurity%20vulnerabilities,%20the%20OIG%20found%20that%20the%20EPA%20does%20not%20have%20an%20incident%20reporting%20system%20that%20water%20and%20wastewater%20systems%20around%20the%20U.S.%20could%20use%20to%20notify%20the%20EPA%20of%20cyber%20incidents.%0A%E2%80%9CCurrently,%20the%20EPA%20relies%20on%20the%20U.S.%20Department%20of%20Homeland%20Security%E2%80%99s%20Cybersecurity%20and%20Infrastructure%20Security%20Agency%20(CISA)%20to%20provide%20this%20type%20of%20reporting%20information,%E2%80%9D%20said%20the%20OIG%20report.%20%E2%80%9CMoreover,%20we%20were%20unable%20to%20find%20documented%20policies%20and%20procedures%20related%20to%20the%20EPA%E2%80%99s%20coordination%20with%20CISA%20and%20other%20federal%20and%20state%20authorities%20involved%20in%20sector-specific%20emergency%20response,%20security%20plans,%20metrics,%20and%20mitigation%20strategies.%E2%80%9D%0AOverall,%20the%20OIG%E2%80%99s%20assessment%20covered%201,062%20drinking%20water%20systems%20for%20cybersecurity%20vulnerabilities%20that%20serve%20more%20than%20193%20million%20Americans.%20Along%20with%20the%2097%20high-risk%20systems,%20the%20OIG%20found%20an%20additional%20211%20drinking%20water%20systems%20servicing%20over%2082.7%20million%20people%20were%20identified%20as%20%E2%80%9Cmedium%20or%20low%20severity%E2%80%9D%20by%20having%20externally%20visible%20open%20portals.%0A%0A%0A%E2%80%9CIf%20malicious%20actors%20exploited%20the%20cybersecurity%20vulnerabilities%20identified%20in%20this%20passive%20assessment,%20they%20could%20disrupt%20service%20or%20cause%20irreparable%20physical%20damage%20to%20drinking%20water%20infrastructure,%E2%80%9D%20the%20OIG%20said%20in%20the%20report.%0AMorgan%20Wright,%20chief%20security%20advisor%20at%20Sentinel%20One,%20said%20threat%20actors%20like%20Salt%20Typhoon%20and%20Volt%20Typhoon%20are%20actively%20exploiting%20vulnerabilities%20in%20water%20systems.%20Wright%20said%20the%20disparate%20system%20of%20water%20and%20waste%20treatment%20facilities%20across%20the%20nation%20lags%20behind%20other%20sectors.%20He%20said%20it%20suffers%20from%20a%20lack%20of%20qualified%20personnel%20and%20appropriate%20budgets.%0A%E2%80%9CUnless%20significant%20action%20is%20taken%20quickly,%20the%20potential%20for%20a%20catastrophic%20event%20is%20closer%20than%20we%20think,%E2%80%9D%20said%20Wright,%20an%20SC%20Media%20columnist.%20%E2%80%9CImagine%20having%20a%20fire%20in%20your%20home%20and%20there%20is%20no%20911.%20Who%20do%20you%20call%3F%20This%20is%20the%20current%20state%20of%20readiness%20in%20one%20of%20the%20most%20critical%20infrastructures%20in%20our%20nation.%20In%20fact,%20during%20war,%20to%20bring%20a%20nation%20to%20its%20knees,%20you%20target%20power%20and%20water.%E2%80%9D%0AKen%20Dunham,%20cyber%20threat%20director%C2%A0at%20the%20Qualys%20Threat%20Research%20Unit,%20added%20that%20U.S.%20water%20systems%20are%20at%20risk%20with%20various%20forms%20of%20governance%20and%20authority%20behind%20state,%20local,%20federal,%20and%20commercial%20entities%20responsible%20for%20management%20of%20facilities,%20where%20some%20have%20largely%20ignored%20security%20practices.%20Dunham%20said%20our%20situation%20here%20is%20in%20sharp%20contrast%20to%20adversaries%20that%20are%20organized%20and%20managed%20by%20a%20government,%20rather%20than%20commercial%20and%20government%20cooperatives.%0A%E2%80%9CWater%20shortages%20are%20significant,%20especially%20based%20upon%20geolocation,%20time%20of%20year,%20and%20supply%20chain%20realities,%E2%80%9D%20Dunhams%20said.%20%E2%80%9CTake%20for%20example,%20middle%20of%20the%20summer,%20Southern%20states%20with%20no%20drinking%20water%20or%20supplies%20to%20the%20home.%20It's%20obvious%20a%20rush%20to%20stores%20for%20drinking%20water%20follows%20with%20various%20forms%20of%20fallout%20and/or%20mayhem.%C2%A0If%20wastewater%20is%20manipulated%20to%20create%20sickness%20and%20pollution%20in%20local%20waterways%20you%20then%20introduce%20large%20scale%20sickness%20and%20impact%20in%20major%20areas.%E2%80%9D%0ADale%20Fairbrother,%20security%20product%20evangelist%20at%20XM%20Cyber,%20added%20that%20several%20analyst%20reports%20have%20highlighted%20that%20although%20board%20members%20and%20compliance%20directives%20continue%20to%20stress%20the%20importance%20of%20cyber%20resilience%20of%20industrial%20control%20systems%20(ICS)%20and%20operational%20technology%20(OT),%20the%20allocated%20budget%20for%20OT%20security%20solutions%20continues%20to%20fall.%0A%E2%80%9CThis%20leaves%20security%20team%20struggling%20to%20extend%20the%20capabilities%20and%20best%20practices%20of%20their%20security%20in-depth%20strategy%20and%20security%20tools%20to%20provide%20the%20coverage%20and%20protection%20needed%20by%20legacy%20and%20OT%20systems,%E2%80%9D%20said%20Fairbrother.%20%E2%80%9CTeams%20that%20continue%20to%20acquire%20security%20solutions%20that%20only%20consider%20a%20subset%20of%20infrastructure,%20assets,%20or%20entity%20types,%20that%20only%20offered%20a%20siloed%20viewpoint%20on%20security%20intelligence,%20often%20mean%20critical%20risks%20to%20ICS%20systems%20are%20often%20overlooked.%20Neglecting%20security%20measures%20for%20ICS%20can%20indeed%20pose%20a%20significant%20threat.%E2%80%9D%0A%0A%0ASteve%20Zurier%0ARelated%0A%0A%0ACritical%20Infrastructure%20Security%0ANeuberger%20recommends%20cyber%20priorities%20for%20Trump%20administration%0ASC%20StaffNovember%2015,%202024%0ACyberScoop%20reports%20that%20the%20incoming%20Trump%20administration%20has%20been%20urged%20by%20Deputy%20National%20Security%20Adviser%20for%20Cyber%20and%20Emerging%20Technologies%20Anne%20Neuberger%20to%20establish%20a%20framework%20for%20minimum%20cyber%20regulations%20for%20critical%20infrastructure%20organizations%20and%20expand%20cybersecurity%20partnerships%20with%20other%20countries%20within%20its%20first%20100%20days.%0A%0ACritical%20Infrastructure%20Security%0AExpanded%20cyberattacks%20launched%20by%20Hamas-linked%20hackers%20against%20Israel%0ASC%20StaffNovember%2015,%202024%0AMounting%20tensions%20in%20the%20Middle%20East%20have%20been%20exploited%20by%20Hamas-affiliated%20threat%20operation%20WIRTE%20which%20had%20been%20linked%20to%20the%20Gaza%20Cyber%20Gang,%20also%20known%20as%20TA402%20and%20Molerats%20as%20it%20sought%20to%20broaden%20intrusions%20against%20organizations%20across%20Israel,%20according%20to%20The%20Hacker%20News.%0A%0ACritical%20Infrastructure%20Security%0AChinese%20targeting%20of%20US%20telecoms%20involved%20extensive%20data%20compromise%0ASC%20StaffNovember%2015,%202024%0AU.S.%20telecommunications%20firms%20were%20confirmed%20by%20the%20FBI%20and%20Cybersecurity%20and%20Infrastructure%20Security%20Agency%20to%20have%20had%20customer%20call%20records,%20private%20communications%20of%20a%20few%20individuals,%20most%20of%20whom%20are%20in%20the%20government,%20and%20sensitive%20information%20that%20require%20law%20enforcement%20requests%20to%20have%20been%20exfiltrated%20by%20Chinese%20state-sponsored%20threat%20actors%20as%20part%20of%20a%20sweeping%20cyberespionage%20campaign,%20reports%20The%20Record,%20a%20news%20site%20by%20cybersecurity%20firm%20Recorded%20Future.%0A%0A%0AGet%20daily%20email%20updates%0ASC%20Media's%20daily%20must-read%20of%20the%20most%20current%20and%20pressing%20daily%20news%0ABusiness%20Email%0ABy%20clicking%20the%20Subscribe%20button%20below,%20you%20agree%20to%20SC%20Media%20Terms%20of%20Use%20and%20Privacy%20Policy.%0ASubscribe%0A%0A%0A%0A%0A%0A%0A%0A%0A%0A%0AAbout%20Us%0ASC%20MediaCyberRisk%20AllianceContact%20UsCareersPrivacy%0AGet%20Involved%0ASubscribeContribute/SpeakAttend%20an%20eventJoin%20a%20peer%20groupPartner%20With%20Us%0AExplore%0AProduct%20reviewsResearchWhite%20papersWebcastsPodcasts%0ACopyright%20%C2%A9%202024%20CyberRisk%20Alliance,%20LLC%20All%20Rights%20Reserved.%20This%20material%20may%20not%20be%20published,%20broadcast,%20rewritten%20or%20redistributed%20in%20any%20form%20without%20prior%20authorization.%0AYour%20use%20of%20this%20website%20constitutes%20acceptance%20of%20CyberRisk%20Alliance%20Privacy%20Policy%20and%20Terms%20of%20Use.%0A%0A%3C/text%3E