S1: Welcome in San Diego. It's Jade Hindman on today's show. When it comes to systems that manage our drinking water and electrical grid. How safe are they from cyber attacks? San Diego based cybersecurity expert and educator Nicholas Bejar weighs in. This is KPBS Midday Edition. Connecting our communities through conversation. In recent weeks , at least seven US states have been hit with cyber attacks. They appear to be targeting critical infrastructure like water and wastewater utilities. So why is this happening and what does it all mean for the safety of U.S. infrastructure? Joining me to help us understand what's happening is Nicolas Bejar. He's a San Diego based cybersecurity expert and educator. Nicholas , thanks for being here on the show.
S2: Thank you for having me.
S1: So help us understand what's what's meant when we hear cyber attacks or cyber warfare? I mean , what falls under that umbrella?
S2: Great question. So cyber attack is not necessarily somebody shutting off , for example , city's water supply with their keyboard. A lot of times it's going to start with something less dramatic. So for example , an internet facing service has weak access control or a system does not have a patch or somebody clicked on a link in a phishing email. But when the target is critical infrastructure , a digital intrusion can potentially disrupt physical services. So you mentioned cyber attack versus cyber warfare. So cyber attack that's an intentional attempt to access or disrupt , manipulate or steal or disable information on a system. When we talk about cyber warfare , that's a little bit more focused because the intent has to be , uh , a nation state type of intent. So they're looking to get access to something to get some sort of information on another nation. So cyber attack is more of a general term , whereas cyber warfare is going to involve state on state action.
S1: I see so from your understanding what just happened here with all these water supply.
S2: So right now what's happening is an example of what's called the cybersecurity dilemma , which is from a great book by Ben Buchanan. So nation states will attack each other in the cyber realm a lot of the times , not in order to cause disruption , but in order to send a signal. So they'll say , okay , I now have access to your water supply , or I can do certain things to your water supply. Now , you all know that I'm there , right? But that we're doing the same thing. We just don't go around and brag about it. So when a nation goes ahead and attacks another nation state , they're sending a signal that , hey , we are now in your environment. Or what they could be doing is they could be hacking in to actually spy on the nation state. So they could be going in and doing reconnaissance and seeing what kind of defenses are present in those types of environments so they can plan further attacks.
S1: And as of late , the nation sending that message to the US is , who is in Iran?
S2: Lately , we've been seeing an uptick in activity from Iran due to the situation that's happening in the Middle East. And they've been stepping up the amount and the severity of the attacks that they've been perpetrating. But it's important to note that it's very difficult to attribute an attack to a certain actor , whether it's a nation state or a criminal group , because we have to have a lot of evidence in order to be certain that it is a nation state act or a particular group.
S1: Well , you know , I mean , so we suspect that that they may be acting. Is there anyone else , um , suspected in these acts?
S2: It could be a wide range of folks. It could be the North Koreans. We've seen their skill level in the cyber realm dramatically increase over the past few years. But in this case , we're suspecting the Iranians just because it's correlated to the action that's happening in the Middle East , unfortunately.
S1: So what makes critical infrastructure like water systems particularly vulnerable to attacks like these?
S2: So that's a great question. Critical infrastructure , unlike , for example , cell phones or laptops that we use , are not meant to be replaced every 3 to 5 years. They're meant to last 30 , 40 , sometimes 50 years. And these systems cannot just be turned off or restarted on a whim. It has to be planned because they underpin their critical infrastructure. They underpin our day to day lives. And so a lot of times what will happen is you'll have outdated systems , uh , that are still in production , that are still in service and that are also out on the internet because they have to be monitored remotely or they have to be updated by third party service providers. And so when that does happen , these systems are out on the public internet , and they're available for both good and bad actors to examine and probe. Hmm.
S1: Hmm. So all that said , is there any concern about whether this is affecting , like , the physical water supply right now? Is it safe to drink?
S2: So just because we have somebody getting into a water environment does not mean that the water is not safe to drink. As I mentioned previously , when an attacker is inside an environment , that doesn't necessarily mean that they're going to do something bad. Because , for example , in this case , if the Iranian actor were to touch critical infrastructure , for example , contaminate drinking water , that could potentially cause a retaliatory action from , for example , the United States. And we've just seen that the Trump administration is starting to allow certain forms of offensive security operations by private organizations based in the United States against other foreign organizations.
S1: And attackers haven't targeted any San Diego systems. Right?
S2: Um , not recently , but if something were to happen in San Diego , it would initially start as an inconvenience. So , for example , we wouldn't be able to pay for permits , we wouldn't be able to pay for fines , maybe our property tax bills , um , things like that. But where it starts to get important is for emergency services. Ideally , they would reroute their communications through some sort of backup channel so they could make sure that , for example , 911 calls could still reach a dispatcher in terms of , for example , water , right? The utility or the water district could shift to manual operations instead of digitally controlled operations , but the most serious outcome is not going to be a computer. Going offline , it's going to be loss of visibility or safe control over an essential physical process like water treatment.
S1: Well , and I'm glad also you brought up emergency services because up in Northern California , cyber attackers recently took over the 911 system of a town there called Siu Sun City. The FBI is investigating that attack. But tell me , is going after a city's 911 system. Is that a normal attack that that you see a lot is that often are those systems often targeted?
S2: So as I mentioned , a lot of these systems are internet facing. And when the attackers are going out and they're looking for targets , they're not necessarily saying , okay , this is a 911 system or this is a hospital or this is an e-commerce website , they're going out and they're casting very , very wide nets. And then when they find something that meets their criteria , they will go ahead and try to exploit that particular vulnerability or weakness. And in this particular case , it just happened that that particular malware incident led , as you mentioned , to the shutdown of certain IT systems. And there was a emergency declared. And the dispatch , as we mentioned , was rerouted to a different county 911 system. So these systems are the ones that underpin critical infrastructure and critical services. A lot of the times are going to be older systems , and they're going to have a longer shelf life than are run of the mill laptop or desktop or cell phone. So they can be susceptible to certain vulnerabilities or weaknesses just due to how long they've been online and how difficult it is to take them offline for maintenance.
S1: Um , what does this say about the need for our systems to be upgraded or more resilient to cyber attacks. Sure.
S2: Sure. So that's a great question. So one of the things that we need to do is we need to establish secure ways to communicate with these systems over the internet. So we want to remove , for example , programmable logic controllers , which are something that control think about like big machinery or critical infrastructure from the internet. We need to make sure that those are only accessible by authorized users from authorized sources. In addition , we want to make sure that we're keeping things like email and file servers on a different part of the network from the critical infrastructure , like our water treatment plants or our electricity generation facilities , things like that. We want them to be separate. So if somebody sends , for example , a malicious email and that link gets clicked on , they're not able to move from that user's inbox very easily to that piece of critical infrastructure. In addition , it's important to have good backups. We want to make sure that systems are backed up and tested right. Because if you're backing up a system and you don't test it , you don't know that it's good. And then there's an issue and you go to restore it and it may not work. So having backups that you know are good is also very important. And in addition , we want to make sure that we plan for these types of events and incidents and that we rehearse our plan. Same thing as with the backups. If we have a plan and we don't know that it works , it doesn't do us any good.
S1: Sounds like a good idea. Is any of that happening , any of this already being done to safeguard our systems from attacks?
S2: So the viewers unfortunately can't , or the listeners can't see the smile on my face , but unfortunately it doesn't happen as often as we would hope. Uh , a lot of systems are left out on the internet without patching , without , um , addressing these weaknesses. And sometimes that can be due to negligence , but other times it could be due to resource constraints. So a lot of these smaller going back to water districts , a lot of these smaller water districts don't necessarily have very , very big budgets , and they don't necessarily have an IT person on staff. Maybe they have a part time person that's coming in , or maybe they have. I know firsthand of some water districts that have interns from the local community college that help manage the the water , the technology that underpins that , that water district , just because they don't have the resources in order to do those types of things , unfortunately.
S1: So what's your biggest concern then?
S2: My biggest concern is , is readiness , right. We have to make sure that we're ready , that we're practicing , that we're aware of the threats. One of the biggest things is making sure that folks are aware of the threats that they're facing and how to handle them. That's why security awareness training is very , very important. And it's also important for the decision makers that are distributing these funds. So local governments and state governments to understand these threats so they can allocate resources appropriately. Because one of the things that I think is happening is the lawmakers and the folks that are controlling the purse strings don't necessarily understand these attacks to the level that is needed in order to provide adequate resources to protect against them. Right.
S1: Right. Which hasn't happened. So then what? Then what? Like , you know , so do we move in anticipation that our water systems , our infrastructure will be attacked and prepare for that?
S2: Or so I like to tell my students and clients that we always want to operate under what's called assumed breach. So it's not an if , but it's a win , right? So everybody's going to get breached if we're not already. There's two types of organizations , the ones who have been breached and know about it and the ones who haven't , uh , who have been breached and don't know about it. So it's only going to be a matter of time. And I think that unfortunately , it's going to take some sort of big news making or catastrophic event in order to change things. Maybe it will happen as a result of the current conflict that we're in. Maybe not. That remains to be seen.
S1: What's the drinking water at your at your house? What's your situation?
S2: Um , so we drink from the tap. Okay.
S1: Okay. Yeah.
S2: Yeah.
S1: All right.
S2: That's tap. Tap water family.
S1: Not worried about. It.
S2: It. Not worried about it? No.
S1: All right. Well , that's that's reassuring. Um , is there any precedent for cyber attacks at this scale? I mean , have we seen anything like this before?
S2: Um , so we've seen nation states get into critical infrastructure on a pretty regular basis. Um , contrast to this , a few years ago , we saw the Chinese government affiliated actors infiltrate the infrastructure on our telecom networks that law enforcement uses to do wiretapping so they can go ahead and listen to any phone conversation that was taking place on a US telecom. They had access to the same system that police and federal agencies use to conduct wiretaps. So it's not the first time that we've seen nation state actors go ahead and get access to critical infrastructure , and it definitely will not be the last because these types of attacks , a lot of the times are used as signals , right? They say , hey , we're inside of your environment. These are the things that we can do.
S1: And then.
S2: And then.
S1: The US does the same.
S2: We just don't talk about it. Okay.
S1: Okay. All right. Well I this is something that we will continue to talk about here. Definitely something we want to follow. I've been speaking with Nicholas Beyer. He's a cybersecurity expert and educator here in San Diego. Nicholas , thank you so very much.
S2: Thank you for having me.
S1: That's our show for today.
S3: I'm your host , Jade Hindman. Thanks for tuning in to Midday Edition. Be sure to have a great day on purpose , everyone.
