Threats of cyber-attacks against public water systems and wastewater systems are increasing. Attacks can interfere with operations and may result in significant response and recovery costs. Of particular concern is the potential disruption in the systems water or wastewater treatment process, leading to the inability to produce clean and safe water.
The department strongly encourages water and wastewater system owners and operators to routinely evaluate their cybersecurity practices and controls and consider steps that may reduce their risk. Owners and operators should also maintain a heightened awareness for possible intrusions into their operational networks and prepare to maintain critical operations if process control networks are disabled.
Evaluate and Plan
The U.S. Environmental Protection Agency (EPA), Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) developed information to help water and wastewater systems reduce risk and improve resilience to malicious cyber activity. That information and more is available below:
- Top Cyber Actions for Securing Water Systems
- Secure Your Business - Basic, low or no cost fundamental cyber hygiene steps that every organization and individual should take to improve their security.
For more information about cybersecurity for public water and wastewater systems visit:
- Cybersecurity and Guidance - American Water Works Association
- Cybersecurity for the Water Sector - EPA
- Water Resources - WaterISAC
- Water and Wastewater Cybersecurity - CISA
Report an Incident
The Missouri Department of Natural Resources set up a dedicated email address for reporting cybersecurity incidents at water and wastewater plants. Send relative details to wpp-cybersecurity@dnr.mo.gov from a non-compromised email account as soon as possible after an incident is discovered.
Missouri water and wastewater treatment systems can get help with cyber incidents by calling the Missouri Information Analysis Center (MIAC) at 866-362-6422.
Alerts and Advisories
When a vulnerability is found, or information regarding a potential cyber threat is uncovered, the U.S. Environmental Protection Agency (EPA) and the Cybersecurity and Infrastructure Security Agency (CISA) will issue an alert. Visit CISA's Cybersecurity Alerts and Advisories webpage for a current list of advisories, alerts and summaries covering industrial control system cybersecurity topics.