Who Is Protecting Our Water From Cyberattacks?

Recent cyberattacks targeting water systems in several states have raised new concerns about the security of essential services that Americans depend on.

While many people assume the state or federal government is responsible for protecting critical infrastructure, the operators of local water systems, electric grids, and other such services largely handle their own cybersecurity.

“The primary responsibility for securing these systems usually falls to the local government or contract organization running the utility or service, with only support from state and federal agencies,” says Daniel Votipka, an assistant professor of computer science at Tufts University and co-director of the Tufts Security and Privacy Lab.

Votipka explains why cybersecurity is as much a human challenge as a technical one—and what makes critical infrastructure especially difficult to protect.

Who does the actual work of securing critical infrastructure?

This varies by the type of infrastructure and jurisdiction. Some larger jurisdictions and well-funded organizations will have cybersecurity teams dedicated to making sure their networks are secure and that any vulnerabilities found in the devices they’re running are fixed.

However, smaller jurisdictions, especially for public utilities, typically do not have the resources to hire dedicated security personnel. So the task falls to IT or engineering employees who are also charged with ensuring the utility continues running at full capacity. Complex machines fail all the time, and keeping essential services running usually takes priority over longer-term cybersecurity work.

Meanwhile, because these organizations typically do not develop the technology they use to deliver services, they often rely on their vendors to mitigate vulnerabilities. This means that if there is a vulnerability found in a device running at a water treatment facility, the vendor needs to produce a patch—a piece of code that the utility can use to fix the security flaw, bug, or weakness in the program or operating system. If the vendor goes out of business or stops supporting an older device, utilities are left at risk.

When people hear “cybersecurity,” they often think about software. But how do people and organizations unintentionally create vulnerabilities?

Attackers often don’t need sophisticated hacking techniques. They can exploit unpatched software, poorly configured systems, or someone clicking a malicious link. These mistakes become more likely when employees are overworked, undertrained, or juggling multiple responsibilities.

And in the cases where vendors design their systems insecurely or are slow to produce vulnerability fixes, utilities often lack a security team dedicated to recognizing potential issues and knowing what alternative steps to take to protect their devices without a patch. 

Why are water systems and other critical infrastructure so challenging to secure?

Many utilities simply don’t have the staffing or budgets that banks and large technology companies devote to cybersecurity. That makes it harder to design secure systems, monitor for threats, and replace outdated equipment before it becomes vulnerable.

Mitigating vulnerabilities in computer systems that control physical equipment also can be especially challenging because it’s hard to assess the impacts of any change. Because these devices interact with the physical world and can have deadly consequences if something goes wrong, technology changes require difficult testing in realistic physical settings or via high-fidelity simulation, which might not capture every possible scenario that could occur in real life. 

My lab is currently working on a U.S. Advanced Research Projects Agency for Health project called UPGRADE, which seeks to address these aspects of cyber defenses in the healthcare setting. 

How do human emotions play into these challenges?

Because it is impossible to test all possible real-world conditions that could ever occur, each cybersecurity security patch introduces new risk that the operators need to understand and accept. Often, fear of the potential impacts of a patch leads operators to put it off. 

Think about how often you’ve hit the “later” button when your web browser or computer suggests an update is needed, because you don’t want to lose time to the computer turning off for a bit or to potentially having to figure out a new interface. Operators of critical infrastructure face the same hesitation—but the stakes are much higher, because an update could unintentionally disrupt an essential public service.

My lab is currently investigating how we can best provide information to operators to assuage these fears and make sure they are able to implement security patches quickly.

If no system can be made perfectly secure, what does resilience look like? 

Resilience means assuming that some cyberattacks will succeed and designing systems so they cannot cause widespread harm.

For example, allowing operators to remotely monitor a water treatment plant carries much less risk than allowing them to remotely change treatment settings. A resilient system might require in-person verification or additional authentication before any changes can be made. That way, even if an attacker gains remote access to the monitoring system, they cannot easily alter the water supply. 

The goal isn’t to eliminate every risk; it’s to prevent a breach from becoming a public safety emergency.

Do you expect AI to amplify existing challenges?

AI could make cyberattacks both easier to launch and harder to detect. It can generate convincing emails and messages to trick employees, help attackers identify software vulnerabilities more quickly, and potentially manipulate data in new ways that appear realistic enough to evade existing safety checks.

For example, in a recent study, hospital clinicians described relying on multiple sources of information, not just one monitor or sensor, and told us they would recognize tampered medical data because it wouldn’t match the rest of the patient’s clinical picture. But if AI enables attackers to create false data that looks medically plausible and fits with other information, those safeguards could become much less effective.

If we could change something tomorrow to meaningfully reduce cyber risk for essential public services, what would it be?

Utilities need more resources to modernize their technology and hire people with cybersecurity expertise. Right now, keeping essential services running often leaves little time or money to address longer-term security risks.

But funding alone won’t solve the problem. We also need technology that is secure by default, continued support from state and federal initiatives that help strengthen utilities’ and other service providers’ defenses, and systems designed with security as an essential part of everyday operations—not viewed as an afterthought or barrier to providing services.

Investing in those areas now will be far more effective than waiting to respond after the next major attack.