NY Funds $9M to Harden Cybersecurity at 153 Water Utilities

Critical water and wastewater infrastructure across New York was found to lack adequate cybersecurity defenses, making it a viable target for state-sponsored threat actors, with Iran suspected in a multistate attack campaign. Many smaller utilities historically operate with limited IT budgets and security expertise, leaving fundamental gaps in assessments, controls, and incident reporting capabilities. The New York SECURE grant program highlights how regulatory pressure combined with targeted funding is necessary to uplift under-resourced critical infrastructure sectors. This matters because compromised water systems can directly endanger public health, and nation-state adversaries are actively probing these weaknesses.

Tactical Insight

Immediate actions

Conduct a baseline cybersecurity risk assessment for all operational technology (OT) and IT systems within water utility environments.
Establish and test an incident reporting workflow that meets state-mandated timelines and notification requirements.
Enroll all staff in mandatory cybersecurity awareness training focused on threats targeting industrial control systems (ICS).

Long-term improvements

Implement network segmentation to isolate operational technology (SCADA/ICS) networks from corporate IT and public internet access.
Develop and maintain a vulnerability management program with regular scanning and prioritized patching schedules for internet-facing assets.
Create a formal incident response plan tailored to water/wastewater operational disruptions, including communication with state and federal agencies.

Detection measures

Deploy continuous monitoring and anomaly detection tools capable of identifying unusual activity on OT/ICS networks.
Establish centralized logging for all critical control system events and review logs on a defined schedule.
Subscribe to sector-specific threat intelligence feeds (e.g., WaterISAC) to receive early warning of campaigns targeting water infrastructure.