National Security Implications of American Water's Cybersecurity Breach and the current Democratic Administration
Seven years ago, American Water underwent a critical assessment to ensure compliance with the DFARS 252-7012 contract requirements. This assessment, conducted by the commercial department of a cybersecurity firm, produced essential compliance documentation, including a Gap Analysis identifying vulnerabilities, a System Security Plan (SSP) detailing the system design, and a Plan of Action and Milestones (POAM). This sensitive documentation was transmitted and stored on an unencrypted server, exposing it to potential interception and unauthorized access.
Fast forward to October 8, 2024, American Water disclosed in a regulatory filing that hackers had breached their computer network. The company stated it was “currently unable to predict the full impact” of the breach. This incident raises severe national security concerns, particularly the possibility that a nation-state threat actor (NSTA) may have maintained access to American Water’s network for seven years. The unsecured transmission and storage of compliance documentation, including detailed vulnerabilities and system design, could have provided the NSTA with a comprehensive roadmap to infiltrate and exploit the system.
The breach resulted in a temporary suspension of customer billing, but the PRIMARY OBJECTIVE OF THE NSTA COULD BE CATISTROPHIC!
American Water is the largest regulated water and wastewater utility company in the U.S., serving over 14 million people across 14 states and 18 military installations. The company manages more than 500 water and wastewater systems in approximately 1,700 communities in states including California, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Maryland, Missouri, New Jersey, Pennsylvania, Tennessee, Virginia, and West Virginia.
During the initial assessment, the most sensitive information—Intellectual Property (IP)—was identified. This included location maps and access details for the public water system infrastructure serving each of the 18 military installations. Such information is critical, as it outlines the physical and operational frameworks that support national defense infrastructure.
Why American Water? In a 2019 LinkedIn post, it was highlighted that a DFARS assessment was performed for a Department of Defense (DOD) prime contractor deemed as “operationally strategic infrastructure in times of conflict.” This contractor supplies water to 13 U.S. military bases. The assessment deliverables included the System Security Plan, Plan of Action and Milestones, and customized Policies and Procedures to meet compliance requirements.”
With the advent of AI technologies like ChatGPT, querying information such as “What commercial company supplies water to 13 of the US military installations?” readily identifies the American Water Military Services Group as the key supplier. This underscores the accessibility of critical information through advanced AI tools, potentially exacerbating security vulnerabilities.
Conclusion: National Security Threats and Regulatory Oversight The release of the 32 CFR final rule highlights the national security threats posed by the Cybersecurity Maturity Model Certification (CMMC) program. Since 2021, the current Democratic Administration and the DOD have facilitated the inadvertent loss of Intellectual Property (IP) by releasing sensitive documents like System Designs, POAMs, Gap Analyses, System Vulnerabilities, Controlled Unclassified Information (CUI), and Federal Contract Information (FCI). These releases have been managed through Memoranda of Understanding (MOU) with commercial companies overseen by Cyber-AB.
This scenario implicates the 57 companies listed as C3PAOs on the Cyber-AB marketplace, potentially holding them liable for transmitting and storing information that POSES THREATS TO NATIONAL SECURITY.
The intersection of commercial service provision, regulatory compliance, and cybersecurity vulnerabilities presents a critical challenge to safeguarding national infrastructure and maintaining the integrity of military operations.
Key Points:
This situation underscores the urgent need for robust cybersecurity practices, especially for companies that support critical national infrastructure and military operations. Ensuring the protection of sensitive information is paramount to maintaining national security and preventing adversaries from exploiting vulnerabilities within essential service providers.
Information Technology and Security Leader
4 个月Brian C. care to chime in?
Leader | Volunteer | Mentor | STEMinist
4 个月I thought DFARS 7012 was a financial assessment?
IT/OT Cybersecurity & Risk Management | International Speaker | Adjunct Professor | Mentor
4 个月The majority of the water/wastewater systems would fall under Specialized Assets, being ICS and OT, and while noted on the SSP, would outside the bounds of audit under NIST SP 800-171. It is accepted practice, as American Water executed, to place the process control systems into a state of “manual” operation to ensure safety and uptime (data confidentially and integrity are not priority within control systems) rendering the the water/wastewater operations, states of operation, and concern somewhat moot in the context of DFARS 252.204-7012 and NIST SP 800-171. American water was quick to point out that water service remained safe and uninterrupted to the community, residential, commercial or otherwise.
CMMC Lead CCA Assessor, Consultant, and Instructor.
4 个月Since she previously said she was the lead assessor, it sounds like she is outing herself as a national security threat.
CMMC Town Crier | Ask me about NIST security controls | Smashing compliance frameworks for fun and profit | Cyber policy wonk |
4 个月Let me see if I understand. CMMC is a national security threat because you think that C3PAOs will hold sensitive assessment information? I can't help but think of this line in the 32 CFR CMMC rule: "Commenter concerns about artifact retention reflect misunderstanding of the assessment process. Assessors and C3PAOs do not retain OSC artifacts, they only retain the hash value captured during the assessment process." This is at least your second post claiming some sort of connection between the American Water Incident and DFARS/CMMC. Have you had a chance to prove that connection based on the details of the techniques used in the compromise?