Iran Hackers Hit 30 Local Water Utilities: Preparing Your Hospital | 2 Minute Drill with Drex DeFord

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

Iran Hackers Hit 30 Local Water Utilities: Preparing Your Hospital | 2 Minute Drill with Drex DeFord

[00:00:01] Drex: Hey everyone, I'm Drex and this is The Two Minute Drill. Special thanks to Fortified Health Security for sponsoring this episode. It's great to see you today. Here's some stuff you might want to know about.
[00:00:12] Drex: Bram, Minnesota is the kind of town you'd probably drive through without really noticing. I grew up in a little town called Plainville, Indiana, and they sound a lot alike. About 800 people in Bram, Water Tower on the edge of town with a name painted on the side.
[00:00:27] Drex: On a late July weekend, that Water Tower stopped filling. The pump didn't break, but the controls that run the Water Tower went offline. And in a town that size, keeping the water running is a couple of people and a panel of switches.
[00:00:43] Drex: So when the panel stopped answering, they did the only thing they could. They ran it by hand. And about 90 minutes later on back up, the water came back up.
[00:00:54] Drex: The mayor is a guy named Nate George. And I think he kind of figured that maybe it was just a glitch, but it turned out it wasn't a glitch. Nate got involved in that same weekend. He figured out that same thing was happening all over Minnesota. Plymouth lost control of two water towers and 14 sewer lift stations.
[00:01:18] Drex: South St. Paul had problems and they had to switch to manual too. So did Mabel Plain. By the time anyone connected the dots, more than 30 Minnesota water systems had been hit inside of 48 hours. A memo later tied the attacks to hackers working for Iran going after the small industrial computers that run water plants.
[00:01:41] Drex: Those computers run the pumps and manage the pressure and manage the chemicals that are added to the water that you drink. And the land wasn't some genius trick. It was a known flaw in a common industrial controller, one that had a fix that was available since 2021. Five years, the patch existed. Bram had just never had anybody to install it.
[00:02:05] Drex: This isn't just a small town problem. Big cities miss those industrial control patches too. A lot of utilities are their own separate corporations. They run on legacy equipment with their own tight budgets and in plenty of cases, a security team of almost nobody.
[00:02:22] Drex: A former FBI official put the point plainly, the goal here is chaos and confusion and fear to make people wonder whether the water coming out of the tap is safe. And it didn't stop in Minnesota. Within days, the FBI was looking at water systems in at least seven states.
[00:02:39] Drex: Now, I just came back from Black Hat, the cybersecurity meeting in Vegas and water and sewage systems and other utility hacking events were the talk of the conference. So here's why I'm telling water plant stories on a healthcare show. When we talk about supply chain risk in a hospital, we usually mean vendors.
[00:02:59] Drex: The EHR, our billing company, our claims system, the imaging software, we send them questionnaires and we sign BAA's with them and we track every third party that touches our data. At least I hope that's the case. But a hospital doesn't run just on data alone. It runs on water and you can't sterilize instruments without it.
[00:03:18] Drex: You can't run dialysis or the boilers or the cooling towers or the sinks in the ER. That water comes from a utility that might have an IT staff of one and a controller that's been sitting in patch since 2021. That town is in your supply chain. That utility is in your supply chain. You just may have never really put it on the list.
[00:03:43] Drex: So think about this. Do you know where your hospital's water and power and steam come from? Have you ever asked those utilities a single security question?
[00:03:54] Drex: And if a foreign government can knock out the water in 30 Minnesota towns over the course of one weekend, what's your plan for the day when it happens at your utility provider? That's it for today's two-minute drill. Drop me a note. Let me know what you're working on. I'm always happy to hear from you.
[00:04:14] Drex: I'm Drex at 229Project.com. Thanks again to Fortified Health Security for sponsoring today's show and thank you for being here. Stay a little paranoid. I'll see you around campus.