Now is the time to strengthen cybersecurity

Recent news of cyberattacks on public infrastructure highlights the need to increase security measures on critical systems. Cyber threat actors (CTA) linked to state-sponsored organizations in Iran and China have recently targeted drinking water supply systems. As a result, the White House sent a letter to all 50 governors directing them to act and protect these critical systems.

While the need to harden potential targets is urgent, fortunately, these fixes can be simple. Public infrastructure facilities should ensure that they employ basic cybersecurity hygiene practices to mitigate cyber threats. These actors often take advantage of facilities that have not implemented these simple and cost-effective best practices.

The White House National Security Council, Cybersecurity & Infrastructure Security Agency, the Environmental Protection Agency, the Minnesota Pollution Control Agency, and the Minnesota Department of Health with support of Minnesota IT Services (MNIT) urge operators to assess their current cybersecurity practices, identify significant vulnerabilities, reduce risks, and create plans to recover from a cyber incident. MNIT has a program called the Cyber Navigator program, which is dedicated solely to this issue.

The Cyber Navigator program has staff that can help local jurisdictions and other partner organizations manage and understand their cyber risks. Cyber Navigators can provide knowledge and resources to ensure secure and resilient operations. The Federal Infrastructure Bill inspired the State and Local Cybersecurity Program, which resulted in Minnesota?s Cybersecurity Task Force Meeting and its Whole of State Cybersecurity Plan. Staff with the Cyber Navigator program have been speaking with state, local, and federal entities involved in water, as well as vendors who provide cybersecurity services to assess the gaps, needs, and current environment. The MNIT Cyber Navigator Team is actively reaching out to contacts at the national, state, and local level. The findings from these engagements will help the Cyber Task Force understand and inform their decisions about how we can best use the SLCGP fund to have the greatest positive impact of cybersecurity resilience across Minnesota.

Contact information for the Cyber Navigator program is listed below.

The time to act is now. We encourage you to follow basic cyber hygiene outlined below to better protect against nation-state threat actors targeting US facilities:

Change default passwords.
Implement multi-factor authentication where appropriate.
Segment networks.
Make sure appropriate policies and procedures are in place, such as removing user access to the network when no longer employed by the entity.

We also strongly recommend public and private partners as well as stakeholders to register for updates at the Minnesota Fusion Center.

Thank you for the continued support and partnerships that allow Minnesota?s critical infrastructure to be protected. Please email the Cyber Navigator team if you have questions or would like more information about any of the cyber-resiliency efforts at [email protected].