Update: Florida Water Treatment Facility Hacked.

After an investigation by officials. The news outlet has reported what exactly took place. Technically there was a “hack” it was an unauthorized individual or group that gained access to the water treatment facility. What they did wasn’t exactly high-tech. The software application had a default password. Not only the problem of default password. They are still using Windows 7. Basically, everything is outdated and there is no hardening process for the facility.

https://cwatch.comodo.com/how-to-hack-username-and-password-of-website.php

Things to do for the water treatment facility: (some might be repeated from last week but now we have a clearer picture of what happened and what needs to be done. Note: not a full list of recommendations)

· Update Windows: They have to update to Windows 10. Windows 7 support has ended on January 14, 2020, and Windows 8 went out of support on January 12, 2016, and both no longer receives security updates.

· System Updates: Even after installing the new OS to machines. It will still be vulnerable without any updates.

· System Configuration: Making sure there is a baseline configuration. Changing all default settings. Closing all unused ports etc., mandating strict password policies

· Application inventory: Making sure all applications are up to date. If unused. Remove it. “Pinellas County Sheriff Bob Gualtieri said the plant had actually stopped using TeamViewer six months ago, but still left it installed according to The Wall Street Journal.”

· Threat detection/prevention: Firewalls, SIEM tools for monitoring, IDS/IPS, honeypots, etc.

· Hiring Pen-testers or periodic vulnerability scanning

There are many frameworks the facility can use. NIST and ISO are the most well-known framework. There are some that target different sectors or industries like ITIL, PIC DDS, or HIPAA. By following a framework. It would have reduced any risk and vulnerabilities that would have caused major harm. There no one framework that will reduce risk to zero. There will always be new ones everyday especially when technology changes so fast but by applying some features. It will minimize it.

These securities shorting coming is alarming. If it can happen in Florida. It can happen anywhere. Following some rules is better than following none.

https://www.microsoft.com/en-us/windows/windows-7-end-of-life-support-information

https://support.microsoft.com/en-us/office/windows-8-end-of-support-and-office-34e28be4-1e4f-4928-b210-3f45d8215595

Turns out that Florida water treatment facility left the doors wide open for hackers

Note: If anything is unclear or incorrect. I Will update upon notification.