Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems

This joint fact sheet, created in collaboration with the Environmental Protection Agency (EPA), supplies Water and Wastewater Systems (WWS) facilities with recommendations for limiting the exposure of Human Machine Interfaces (HMIs) and securing them against malicious cyber activity.

In the absence of cybersecurity controls, threat actors can exploit exposed HMIs at WWS Sector utilities to view the contents of the HMI, make unauthorized changes, and potentially disrupt the facility’s water and/or wastewater treatment process. CISA strongly encourages WWS Sector organizations review and implement the mitigations in this fact sheet to harden remote access to HMIs.

Please share your thoughts with us via our anonymous product survey; we welcome your feedback.