On the August 5 StateScoop Priorities Podcast, Patrick Gillespie, OT practice director at the firm GuidePoint Security, called the water utility cyberattacks in Minnesota opportunistic. The recent attacks ultimately affected 12 states, with the federal government investigating Iran’s possible involvement. “The reason this is happening right now,” Gillespie explains “is these are inherently insecure devices directly connected to the internet. They have no firewall, no cyber protections on the devices themselves or a firewall in front of them. It is not sophisticated attacks. It’s essentially low-hanging fruit, just devices that are legacy, sometimes years or decades old, without encryption, without authentication or sometimes default credentials.”
On July 30, the Federal Bureau of Investigation and the Environmental Protection Agency issued a Public Service Announcement to warn critical infrastructure asset owners and operators that malicious cyber actors are conducting cyber attacks targeting Operational Technology (OT) devices. The FBI reported that “after remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.”
In the announcement, the FBI and EPA recommended that individuals take the following cybersecurity precautions:
According to a July federal audit, as reported in News from the States on July 30, 9,000 children in foster care temporarily stayed in hotels, offices and other unlicensed settings, including cabins in state parks. Of the 49 states that responded to the Inspector General’s questionnaire, 34 reported temporarily placing children in these unlicensed settings. States with a high number of placements, according to the report included: Arizona, Texas, Tennessee, Illinois and Washington state. Seven states reported not placing any children in emergency settings; these included Connecticut, Iowa, Massachusetts, New Jersey, Rhode Island, Utah and Wyoming.
According to the audit, National Overview of State-Level Challenges and Efforts To Minimize or Eliminate Temporary Emergency Placements in Foster Care, other findings included:
During a GovRAMP panel the theme centered on the shared responsibility of state cybersecurity. Leah McGrath, Executive Director of GovRAMP, moderated the discussion at GovForward’s 8th Annual Carahsoft Summit on FedRAMP on July 23 in Washington, D.C. That shared risk management requires government agencies, technology providers, and other stakeholders to work together to identify, manage, and reduce cybersecurity risk. According to GovRAMP, that “success depends on trusted partnerships, common security expectations, and a commitment to continuous improvement across the entire public sector ecosystem.” Members of the panel included Shawnzia Thomas, State Chief Information Officer, State of Georgia; David Resler, Chief Operating Officer and Chief Technology Officer, GovRAMP; and Charles Rote, State Chief Information Security Officer, State of Maine. “Cybersecurity is no longer the responsibility of a single organization—it requires shared ownership, trusted partnerships, and a commitment to protecting the public together,” said Thomas.
Renee Moseley joined GL Solutions in 2016 with an educational and professional background in research and writing, along with software documentation. At GL Solutions she produces informative content to help regulatory agencies stay current on news and information that supports their success.
