Top White House cyber aide says recent Iran hack on water system is call to tighten cybersecurity – CBS News

Watch CBS News
/ AP
A top White House national security official said recent cyber attacks by Iranian hackers on U.S. water authorities — as well as a separate spate of ransomware attacks on the health care industry — should be seen as a call to action by utilities and industry to tighten cybersecurity.
Deputy national security adviser Anne Neuberger said in an interview on Friday that recent attacks on multiple American organizations by the Iranian hacker group “Cyber Av3ngers” were “unsophisticated” and had “minimal impact” on operations. But the attacks, Neuberger said, offered a fresh warning that American companies and operators of critical infrastructure “are facing persistent and capable cyber attacks from hostile countries and criminals” that are not going away.
“Some pretty basic practices would have made a big difference there,” said Neuberger, who serves as a top adviser to President Joe Biden on cyber and emerging technology issues. “We need to be locking our digital doors. There are significant criminal threats, as well as capable countries — but particularly criminal threats — that are costing our economy a lot.”
The hackers, who U.S. and Israeli officials said are tied to Tehran’s Islamic Revolutionary Guard Corps, breached multiple organizations in several states including a small municipal water authority in the western Pennsylvania town of Aliquippa. The hackers said they were specifically targeting organizations that used programmable logic controllers made by the Israeli company Unitronics, commonly used by water and water treatment utilities.
Matthew Mottes, the chairman of the Municipal Water Authority of Aliquippa, which discovered it had been hacked on Nov. 25, said that federal officials had told him the same group also breached four other utilities and an aquarium.
The Aliquippa hack prompted workers to temporarily halt pumping in a remote station that regulates water pressure for two nearby towns, leading crews to switch to manual operation.
The hacks, which authorities said began on Nov. 22, come as already fraught tensions between the U.S. and Iran have been heightened by the two-month-old Israel-Hamas war. The White House said that Tehran has supported Houthi rebels in Yemen who have carried out attacks on commercial vessels and have threatened U.S. warships in the Red Sea.
Iran is the chief sponsor of both Hamas, the militant group which controls Gaza, as well as the Houthi rebels in Yemen.
The U.S. has said they have uncovered no information that Iran was directly involved in Hamas’ Oct. 7 attack on Israel that triggered the massive retaliatory operation by Israeli Defense Forces in Gaza. But the Biden administration is increasingly voicing concern about Iran attempting to broaden the Israeli-Hamas conflict through proxy groups and publicly warned Tehran about the Houthi rebels’ attacks.
“They’re the ones with their finger on the trigger,” White House national security adviser Jake Sullivan told reporters earlier this week. “But that gun — the weapons here are being supplied by Iran. And Iran, we believe, is the ultimate party responsible for this.”
Neuberger declined to comment on whether the recent cyber attack by the Iranian hacker group could portend more hacks by Tehran on U.S. infrastructure and companies. Still, she said the moment underscored the need to step up cybersecurity efforts.
The Iranian “Cyber Av3ngers” attack came after a federal appeals court decision in October prompted the EPA to rescind a rule that would have obliged U.S public water systems to include cybersecurity testing in their regular federally mandated audits. The rollback was triggered by a federal appeals court decision in a case brought by Missouri, Arkansas and Iowa, and joined by a water utility trade group.
Neuberger said that measures spelled out in the scrapped rule to beef up cybersecurity for water systems could have “identified vulnerabilities that were targeted in recent weeks.”
The administration, earlier this year, unveiled a wide-ranging cybersecurity plan that called for bolstering protections on critical sectors and making software companies legally liable when their products don’t meet basic standards.
Neuberger also noted recent criminal ransomware attacks that have devastated health care systems, arguing those attacks spotlight the need for government and industry to take steps to tighten cyber security.
A recent attack targeting Ardent Health Services prompted the health care chain that operates 30 hospitals in six states to divert patients from some of its emergency rooms to other hospitals while postponing certain elective procedures. Ardent said it was forced to take its network offline after the Nov. 23 cyberattack.
A recent global study by the cybersecurity firm Sophos found nearly two-thirds of health care organizations were hit by ransomware attacks in the year ending in March, double the rate from two years earlier but dipping slightly from 2022.
“The president’s made it a priority. We’re pushing out actionable information. We’re pushing out advice,” Neuberger said. “And we really need the partnership of state and local governments and of companies who are operating critical services to take and implement that advice quickly.”

Associated Press writers Frank Bajak in Boston and Marc Levy in Harrisburg, Pa., contributed reporting.
First published on December 10, 2023 / 3:34 PM EST
© 2023 The Associated Press. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed.
©2023 CBS Broadcasting Inc. All Rights Reserved.

source

Related Posts

After 6 months and little explanation, Norton Healthcare patients, employees still feeling effects of cyber attack – WDRB

Spotty shower possible. Storms after midnight Updated: April 16, 2024 @ 12:31 pmNorton Healthcare, a company serving about 600,000 patients a year with nearly $5 billion in assets, continues to…

Read more

CA's top cybersecurity job has been vacant for almost 2 years – CalMatters

Technology Californians get hacked all the time. The state’s top cybersecurity job is vacant In summaryGov. Newsom has yet to appoint a commander who is tasked with informing businesses and…

Read more

13 Cyber Security Measures Your Small Business Must Take – Tech.co

Our content is funded in part by commercial partnerships, at no extra cost to you and without impact to our editorial impartiality. Click to Learn MoreCybersecurity has been important to…

Read more

AVG Antivirus Free review – Ghacks

AVG AntiVirus Free is a longstanding security program for Microsoft Windows that protects computer systems from viruses, trojans and other malicious code.One interesting fact about AVG is that it maintains…

Read more

Vlog Episode #247: Chris Long on Improving Technical SEO Skills & Playing Offense SEO – Search Engine Roundtable

In part one, we learned about Chris Long and his experience working with Bill Slawski. Then, in part two, we spoke about helping people with SEO on LinkedIn and using…

Read more

Information Security Vs. Cybersecurity: What's The Difference? – Forbes

Information Security Vs. Cybersecurity: What’s The Difference?  Forbessource

Read more

Leave a Reply

Your email address will not be published. Required fields are marked *