Recommendations Following the Oldsmar Water Treatment Facility Cyber Attack

The City of Oldsmar disclosed an unlawful intrusion of its water treatment control system in which an attacker remotely accessed an operator workstation via TeamViewer and raised the sodium hydroxide (NaOH) dosing setpoint from about 100 ppm to 11,100 ppm; an on-duty operator observed the activity and restored normal settings before pH alarms were triggered. The report details detection and mitigation guidance: identify TeamViewer installations and DNS resolutions to *.teamviewer.com; monitor traffic on TCP/5938 and UDP/5938 (with fallbacks to TCP/443 and TCP/80); enforce MFA and jump-host DMZ architectures for remote access; log and monitor remote sessions; block unauthorized egress; and consider isolated safety systems to prevent hazardous process changes.