Cybersecurity Under Siege: The State of Critical Infrastructure Protection in 2025
Critical infrastructure systems, including water utilities and energy grids, remain a prime target for cyberattacks, as highlighted by a recent warning from the Cybersecurity and Infrastructure Security Agency (CISA). Vulnerabilities in operational technology (OT) and industrial control systems (ICS) have left essential services exposed, posing significant risks to public safety and national security.
A Costly Reality
The financial impact of cyberattacks on the industrial sector has been staggering. The 2024 IBM Cost of a Data Breach Report revealed an average cost of $5.56 million per breach in the industrial sector, marking an 18% increase from 2023. This represents the largest year-over-year rise among all industries surveyed, with an average increase of $830,000 per breach.
These escalating costs underscore the urgent need to address systemic vulnerabilities, particularly as attackers continue to exploit poor cyber hygiene practices like the use of default passwords and unpatched systems.
The Arkansas City Water Treatment Facility Breach
One recent incident exemplifies the growing threats to critical infrastructure: a cybersecurity breach at the Arkansas City Water Treatment Facility on September 22, 2024. While city officials assured the public that the water supply remained safe and uninterrupted, the attack forced the facility to switch to manual operations.
The incident is currently under investigation, but experts warn it reflects a broader trend of attacks on water systems. According to CISA, outdated OT environments and unsecured ICS systems remain key vulnerabilities. Cybercriminals often use simple tactics, such as brute-force attacks, to compromise these systems, raising concerns about the preparedness of critical infrastructure operators.
Hacktivist Threats and Geopolitical Risks
CISA’s latest alert follows a series of warnings in 2024 about cyber threats from Russia-affiliated hacktivists, including the Cyber Army of Russia Reborn, a group linked to Advanced Persistent Threat 44 (APT44), also known as Sandworm. These actors have exploited weak cybersecurity postures, particularly among smaller water utilities with limited resources.
“We expect these attacks to continue for the foreseeable future,” said Keith Lunden of Mandiant. “Many small- and mid-sized organisations lack dedicated cybersecurity personnel, making them easy targets.”
The rise in hacktivist activity, coupled with sophisticated nation-state threats, has heightened concerns about the resilience of U.S. critical infrastructure.
Government Response: Funding and Strategic Initiatives
To counter the growing threats, the U.S. Department of Homeland Security (DHS) allocated $280 million in grant funding for the State and Local Cybersecurity Grant Program (SLCGP) in fiscal year 2024. This funding is aimed at enhancing cybersecurity for state, local, tribal, and territorial governments, with a focus on critical infrastructure systems like water utilities and energy grids.
The grants will support initiatives such as:
- Implementing multi-factor authentication.
- Enhancing monitoring systems.
- Conducting regular system audits.
- Providing cybersecurity training for staff.
In Michigan, for example, local water utilities are already benefiting from government-led cybersecurity training programs, with the DHS funding expected to expand these efforts nationwide.
The Role of the Cyberspace Solarium Commission
The Cyberspace Solarium Commission (CSC), established in 2019, has implemented approximately 80% of its recommendations to develop a national cyber defence strategy. However, critical gaps remain, particularly in private-sector collaboration and insurance reforms.
Key priorities include:
- Minimum Security Standards: Establishing baseline cybersecurity requirements for high-priority infrastructure.
- Economic Continuity Plans: Developing resilience plans to protect the U.S. economy during a major cyber event.
- Information Sharing: Improving cooperation between government, private industry, and international partners.
Senator Angus King, co-chair of CSC 2.0, acknowledged the challenges of fostering trust between the government and private sector. “Private entities own the majority of critical infrastructure, but historical tensions make collaboration difficult,” he noted.
A Wake-Up Call for Critical Infrastructure Operators
The Arkansas City incident and similar breaches serve as a stark reminder of the vulnerabilities facing critical infrastructure. From small water utilities to large-scale energy providers, the risks are clear, and the need for action is urgent.
Recent attacks attributed to China-linked hackers have further underscored the scale of the problem. According to the FBI, over 260,000 network devices have been compromised, with attackers exploiting vulnerabilities in Versa Networks’ SD-WAN software to target internet service providers and managed service providers.
The Path Forward
The cybersecurity landscape for critical infrastructure remains fraught with challenges. While initiatives like the DHS grants and CSC recommendations are steps in the right direction, experts agree that more needs to be done.
“Without rapid intervention and collaboration, these attacks will continue to escalate,” warned Lunden.
The safety and resilience of critical infrastructure systems are not just technical issues; they are matters of public trust and national security. As the threat landscape evolves, operators, policymakers, and the public must work together to ensure these vital systems are protected.
With public safety and economic stability at stake, the time to act is now.