On Monday, September 11, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet on its free Cyber Vulnerability Scanning (VS) service for Water and Wastewater utilities. The fact sheet was developed in coordination with the EPA, the Water Sector Coordinating Council (WSCC), and the Association of State Drinking Water Administrators (ASDWA).

The VS service, according to CISA, continuously assesses the health of internet-accessible assets by checking for known vulnerabilities, weak configurations—or configuration errors—and suboptimal security practices. The VS service also recommends ways to enhance security through modern web and email standards. Immediate practical benefits for utilities enrolling in this service include identification of internet-accessible assets, detection of vulnerabilities, and weekly reports with recommendations for mitigating identified vulnerabilities.

Many utilities that participate in this service experienced a significant reduction in vulnerabilities during the initial months of scanning. As of July 2023, there were 165 water and wastewater utilities enrolled in CISA’s vulnerability scanning, out of approximately 168,000 drinking water and wastewater systems across the country. CISA, EPA, the WSCC, and ASDWA encourage  drinking water and wastewater utilities to enroll in the free Vulnerability Scanning (VS) service to help network defenders reduce exposure to cyber threats by taking a proactive approach to mitigating potential attack vectors.

Additionally, CISA will be discussing more about the VS service during WaterISAC’s Cyber Threat Briefing on September 27, 2023. Register here to learn more about CISA’s Vulnerability Scanning service and for an overview of the latest Cyber Risk Summary findings from reviews across  the water and wastewater sector. During the Cyber Threat Briefing on September 27, we’ll also be hearing from a water utility on its perspective on the Vulnerability Scanning service. Access the full factsheet at CISA here.