Florida Water Treatment Plant Hacked

, ,

Over the last several years, we’ve seen utilities increasingly become a target for cybercrime. On Friday, February 5th, an unidentified assailant remotely accessed a computer that is a part of the SCADA system at the City of Oldsmar’s water treatment plant. In an attempt to poison the city’s water supply, the assailant briefly increased the amount of sodium hydroxide by a factor of more than 100. Thankfully, a supervisor noticed this increase and immediately reversed it, causing no harm to the water supply.

Read More About This Incident

While beneficial to utilities, SCADA systems open the operation up to many cyber threats when the proper protocols and security are not in place. In 2019, we wrote the following article for the Tennessee Association of Utility District’s publication, Tennessee Utility News, outlining benefits, threats, and best practices for protecting SCADA systems.

Have questions?   Need help securing your system?

That’s what we’re here for! Reach out, and we’ll be happy to help!

Making Data Work for You:

SCADA for Utilities

Throughout the utility sector, SCADA (Supervisory Control and Data Acquisition) systems are becoming more and more prevalent. SCADA systems are a type of industrial control system that enables utilities to easily collect useful data, monitor operations, and automate many processes. For the utility industry, SCADA systems can have many different applications. SCADA systems can give operators and administrators instant access to information that was previously unavailable or difficult to obtain. SCADA systems can be used to monitor and control pump stations, monitor water in tanks and reservoirs, perform remote shut-offs and turn-ons, collect data for regulatory and financial reporting, among many other useful applications. These networks are not a one size fits all solution, however. They may be small or complex, only address one small portion of operations or encompass them all.  SCADA systems are becoming essential to water and wastewater system operations, monitoring, maintenance, and planning.

The heart of SCADA is the data it generates.

SCADA systems are typically made up of field equipment, data collection equipment, communication networks, and software.  Field equipment such as sensors or relays allow the utility to monitor and automate their system through the creation or consumption of data. This data is communicated via fixed or wireless communication networks through the use of Remote Telemetry Units (RTUs) or Programmable Logic Controllers (PLCs) that are connected to the sensors or relays in the field. In most cases, these RTUs or PLCs perform real-time, continuous data collection, giving the utility easy access to data that enables operators to create and maintain a high level of control.

We’ve established that SCADA systems communicate data, but where is this data going? How is it being turned into action? The final piece of any SCADA system is a host platform. The host platform is comprised of hardware such as servers or a cloud solution as well as software. It is here where the actual benefit of a SCADA system comes to fruition. It is here where data is received, integrated, analyzed, and turned into actionable items. The large amounts of data that are generated by SCADA systems can be onerous and overwhelming. Having software and solutions that ensure that this data is processed properly, organized, and stored is essential to the performance of the SCADA system.

Protecting SCADA data and connected systems.

Just as SCADA continues to increase in popularity, so does the threat posed by outside sources. Over the years, we’ve heard mention of the threat posed by terrorists, hackers, and less than satisfied customers and employees. How do you protect your system from these outside threats and ensure that you avoid any loss of service?

The threat of cyber-attacks and cyber warfare is growing each day, and we see every day that utilities are not taking the necessary steps to protect their network. This topic is one that is constantly being discussed, but many times, no changes are being implemented. The two most common reasons are that many utilities do not grasp the reality that it could happen to them or the cost seems prohibitive to protect and monitor their system.

Threats to SCADA systems include but are not limited to:

Employee Error: Employees are a common cause of network security issues. While it is possible to suffer the wrath of a disgruntled employee, most commonly, network security issues caused by employees are unintentional and can many times be attributed to poor training, carelessness, or a combination of both. With proper training for employees and an active culture of vigilance, you can help your organization reduce issues caused by employee error.

Malware: Malware includes viruses, spyware, and an array of other malicious programs. These programs may not necessarily target SCADA, but because the SCADA network is not separated or protected, they are able to traverse over the entire network, thusly affecting the SCADA system.

Hackers: Intentional, malicious individuals or groups that are intent on gaining access to the network. These hackers could also use this data against you. By manipulating data or gaining complete control of your SCADA systems, serious harm can be caused to services, customers, and the entire operation.

"Using a combination of security policies and controls to adequately secure today’s systems is critical to your organization’s operation"

So what can you do:

The first step utilities need to take is documentation of your network connections to the internet. Any and all internal networks must be properly documented. All hardware, software, firmware, and applications need to be part of that documentation. All users, including outside vendors that have access to these systems, should also be documented. It is vital that utilities create and maintain accurate and thorough documentation of all connections to, pieces of, and access to their network.

In most cases, SCADA systems lack adequate monitoring and detection systems, making them vulnerable to attacks from external and internal sources. Setting up monitoring and detection controls is the next step in protecting your SCADA system. There are many different types of monitoring and detection software on the market. Selecting the software that is best for your particular operation can be a difficult task. We suggest that you work closely with network professionals to evaluate your specific network needs.

Once you have documented and set up adequate monitoring and detection systems, you can then begin to segment the network. Segmenting the network should be used to separate other business systems that are running on the same network as the SCADA system. Due to the fact that attacks are increasingly exploiting both physical and cyber vulnerabilities, it is important to align physical security and cybersecurity processes. Application whitelisting, firewalls, and gateways are all ways to build a defensive perimeter around your SCADA systems.

Security is also something that is in continual motion. Rules, security checks, report monitoring, and standardized processes must be instituted and utilized by everyone who has access to the SCADA system and all other connected networks. Regular evaluations must also be performed for vulnerability, risk, and all assets in general.  These assessments should be conducted on a regular basis to verify that security measures are adapting to the changing threats on the IT landscape.

Using a combination of security policies and controls to adequately secure today’s systems is critical to your organization’s operation. Understanding common weaknesses, creating and implementing an action plan to bring security to an acceptable level, and employing standardized processes will minimize the risk posed by an increasingly hostile Internet environment.

/by

Itron Utility Week 2020

, , ,

Over the last two weeks, our Sales & Marketing has had the privilege of participating in Itron Utility Week and the Itron Partner Conference in a virtual format. While these conferences looked different this year, we could connect with utilities, industry leaders, and partners from across the country with innovation at the center of many conversations.

We heard from Itron, Inc. President & CEO, Tom Deitrich on the importance of innovation in our industry and how Itron Inc. solutions and ideas can be harnessed to meet the challenges that the utility industry is facing today as consumer expectations change, cities become more interconnected, and sustainability needs increase.

“We can empower innovation by sharing fresh ideas with endless possibilities, and together, create a more resilient, more reliable, safer and more resourceful world.” – Tom Deitrich

Throughout the last two weeks, we had the opportunity to witness how Itron, Inc. solutions can allow utilities and cities to address these changing needs and create a better future for the industry. The use of intelligence and analytics offered by these solutions will enable utilities to increase customer engagement, reduce water loss, better manage energy, and respond to changing real-time conditions. With the ever-increasing amount of data at utility’s fingertips, it’s more important than ever that we turn that data into actionable items. Having information is the first step; turning this data into progress is the second. Many utilities struggle with managing and acting upon data. Many solutions and ideals discussed over the last two weeks give utilities the tools needed to ride into the future, better prepared, and ready to ensure long term sustainability.

We want to thank Itron, Inc., for the ability to participate in these thought-provoking and informational sessions. We look forward to sharing the valuable insights gained with our customers!

/by

Preventing Fraudulent Utility Accounts

Before coming to work at United Systems, I had never once heard of fraudulent utility accounts. I quickly learned that this was a very serious and costly issue that many utilities face. Let me explain… we’re going to call our customer Judy. Judy doesn’t pay her bill, and her service gets shut off. Instead of paying the bill and the fee for reconnection, Judy comes in and opens an account in her boyfriend, John’s name. A couple of months go by, and John’s account gets shut off. Well, here come Judy and John, and they open an account in their son, Joe’s, name and the cycle continues. Accounts opened in roommates, spouses, and even kids names happen regularly. The delinquent amounts and disconnect/reconnect fees are never recovered, and the utility takes a loss.

Working closely with utilities over the last several years has led me to some best practices to avoid these types of fraudulent accounts.

  • First, you want to ensure that your CIS/utility billing software allows you to store customers’ driver’s licenses and related identification numbers, etc.
  • Second, you want to ensure that you are gathering and storing this information on the customer record. We suggest that if you have not been attaching this information to customer or account records, you update or add the info as you interact with customers— real-time.
  • For an added step of security, scan an image of the customer’s driver’s license or I.D. Economical, high-speed I.D. scanners are most helpful to your CSR’s during this process.
  • Utilize CIS service applications and attach these images directly to their CIS billing account.
  • When a customer comes in to open a new account, look-up their service location of record to determine if there are any disconnected or delinquent accounts at that location.
  • Also, search by name to examine if they have additional accounts left delinquent at other service locations.

The key to overcoming fraudulent accounts is information. Ensuring that your CIS/billing software stores the necessary information and tracks relevant data on the customer, location, and billing account is essential.  This software functionality used in conjunction with the record keeping steps above can save your utility money in the long run!

/by

Single Source Provider

,

Is your utility using multiple vendors for utility billing, online bill pay, financial management, outsourced billing, network management, and meter reading software? The typical answer is: “yes.” The majority of utilities spread their technology and software services across multiple vendors. Each of these vendors have their own requirements, processes, and support. Integrations between systems are pieced together and tend to cause more headaches than benefits. Finding a vendor that meets all your utility’s technology needs is a rare occurrence. United Systems is that vendor.

Since 1977 United Systems’ priority has been helping utilities meet their goals through the use of technology. We developed comprehensive solutions based on direct feedback from our customers that addresses the specific needs of utilities. Through this process, we have discovered that many utilities struggle daily with using multiple systems to accomplish tasks that should be cohesive. We took these struggles to heart and have worked to create solutions that meet these needs in a coherent and all-encompassing manger.

United Systems & Software, Inc. offers a comprehensive suite of software designed to meet the utility billing needs, inventory needs, asset management needs, and financial needs of utilities as well as various city management functions. Our in-house staff develops all of our software, and from its inception, our software is designed with seamless integration in mind. As the nation’s leading Itron, Inc. AMR & Fixed Network Distributor, we are innately aware of the meter reading needs of utilities and how vital it is that your meter reading system and utility billing software compliment and communicate with each other. Our TPM by United Systems team consists of networking professionals that have the knowledge and skills necessary to keep your utility infrastructure safe and to ensure that your hardware is up to date, secure, and functioning properly.

Having multiple different vendors for all these functions can make day to day operations difficult at a utility. In situations where a utility is using various different vendors, the system tends to be disjointed. Employees have to go between many different vendors, with each vendor blaming the other for the issues the utility is experiencing most times. Getting answers and solutions is like swimming, upstream…difficult, and useless. Your readings aren’t importing correctly; do you call your software vendor, your AMR/AMI vendor, or is it a networking issue preventing the file from importing? Your general ledger entries are out of balance; did you enter an entry from your utility billing incorrectly, was it a voucher paid to a vendor, or a payroll entry? Where do you even start?

With United Systems, you only have one vendor to call. We support and assist you with your entire system from your telephones, to protecting your data, to the radio transponders on your meters, to ensuring that your utility bills are printed and mailed on time. 

Have questions or want to learn more? Reach out to our highly trained account management team:

Phone: 1.800.455.3293

Email: marketing@united-systems.com

/by