CISA and EPA Warn of Cyber Risks to Water System Interfaces

CISA and the EPA issued a joint fact sheet warning that internet-exposed Human Machine Interfaces (HMIs) create significant cybersecurity risks for the Water and Wastewater Systems sector; exploited HMIs can allow unauthorized manipulation of treatment processes, disable alarms, or lock operators out, and recent disruptive incidents (including those attributed to pro‑Russia hacktivists) underscore the threat. The guidance urges disconnecting HMIs from public internet access where possible, enforcing strong passwords and MFA, applying software/firmware updates, implementing network segmentation (e.g., DMZs), and monitoring login activity, and highlights CISA’s free vulnerability scanning and sector-specific resources to help utilities remediate weaknesses.