Skip to main content

Cybersecurity for the water sector

Vector illustration of a data security services.
Environment, Great Lakes, and Energy

Cybersecurity for the water sector

The Michigan Cyber Command Center (MC3) is responsible for the coordination of combined efforts of cyber emergency response during critical cyber incidents in Michigan. Emphasis is placed upon prevention, response, and recovery from cyber incidents.

MC3 works collaboratively with the Michigan Department of Environment, Great Lakes, and Energy  (EGLE), the Cybersecurity and Infrastructure Agency (CISA), Federal Bureau of Investigation (FBI), and the U.S. Environmental Protection Agency (EPA) to provide an overview of the cyber threats facing the water sector (drinking water, wastewater, industrial storm water) and additional resources that you can use to learn more about cybersecurity best practices and reducing the risk of cybersecurity threats. EGLE recommends that water sector utilities contact the MC3 to initiate criminal investigative assistance and response as soon as a critical cyber incident is identified.

Advisories and alerts

Cybersecurity assessments

A cybersecurity assessment is a process that helps organizations identify, evaluate, and mitigate cyber risks to their operations, assets, and personnel. It involves analyzing vulnerabilities, threats, and security measures to enhance overall cybersecurity resilience. Cybersecurity assessments are not mandated by the Safe Drinking Water Act, but they are highly recommended.

Take the next step
Screenshot of EGLE cybersecurity assessment flyer

Cybersecurity best practices

To prevent the potential compromise of your water utility, it is important to take the following steps:

  • Ensure all default passwords are changed to a complex and unique 16-character password

  • Require multifactor authentication

  • Review and apply the latest security patches and updates provided by your hardware/software vendor

  • Continuously monitor network traffic and system logs for suspicious activity

  • Keep up-to-date offline backups

Other steps to take:

  • Educate employees about the risks of phishing attacks and social engineering tactics cyber adversaries may use to gain unauthorized access.
  • Conduct regular cybersecurity training sessions for employees to enhance awareness.
  • Consider engaging cybersecurity experts for a comprehensive assessment of your water utility’s digital infrastructure to identify potential vulnerabilities.
View the top cyber actions for securing water systems

Training and webinars

Contact us

For questions, contact the Michigan Cyber Command Center at MC3@Michigan.gov or by calling 877-MI-CYBER (877-642-9237).

Partners

  • Cybersecurity & Infrastructure Security Agency (CISA)

  • Environmental Protection Agency (EPA)

  • Internet Crime Complaint Center (IC3)

  • Water Information Sharing Analysis Center (WaterISAC)

  • Michigan Cyber Command Center (MC3)

  • Michigan Cyber Partners