Interior IG: Nation’s Dams Safe From Hacks But Vulnerable to Insider Threats

The nation’s hydroelectric dams are likely safe from outside hackers but the threat from within is very real, according to a new internal Interior Department report.

An inspector general review of critical hydroelectric dams showed little risk of hackers breaching the advanced industrial control systems, or ICS, that operate the dams. However, investigators found significant weaknesses in the management of employee access, making the dams highly vulnerable to insider threats.

Interior’s Bureau of Reclamation manages more than 600 dams in the Western U.S., five of which are hydroelectric dams considered to be critical infrastructure. A June 7 inspector general reporter released publicly late Monday looks at the cybersecurity posture of two such dams.

“We found the industrial control system at low risk of compromise from external cyber threats as our analysis of computer network traffic showed that ICS is isolated from the internet and from USBR’s business systems,” investigators wrote, adding their “analysis of the ICS computer memory did not detect hidden malware or other indicators of compromise.”

However, the bureau’s employee and account management “put the ICS and the infrastructure it operates at high risk from insider threats,” the report states.

Hydroelectric dams sit as a particularly precarious cross-section of critical infrastructure: They provide electricity to large populations, create reservoirs for drinking water and irrigation and help prevent seasonal flooding. Tampering with any one of these functions could have dire effects on the people served by the dam.

In an even more nightmarish scenario, compromising the release mechanisms or structural integrity of the dam could bring a torrent of water crashing down on those living beneath, causing severe loss of life and property.

While the ICS were sufficiently walled off, investigators found the bureau gave privileged access to critical IT systems to far too many users—some without sufficient background checks—and did not remove old users or comply with password policies.

Specifically, the bureau:

• Failed to limit the number of ICS users with administrator access.
• Created and authorized 18 group accounts with administrator access, “even though tracing ICS changes back to the one who made the change is impossible and thus a significant control deficiency.”
• Did not require additional background checks for employees with elevated system privileges.
• Did not remove and rescind access to dormant accounts, including nine of 30 ICS administrator accounts and seven of the 18 group administrator accounts.
• Failed to implement password best practices: 10 of 30 administrator accounts have not changed their passwords in over a year.

Investigators said these deficiencies grew into serious vulnerabilities over time, as Reclamation “failed to strengthen bureau risk management practices in response to rapidly escalating threats to critical infrastructure.”

The IG made five recommendations to fix these weaknesses:

• Implement least privilege access by limiting the number of employees with elevated privileges.
• Eliminate all ICS group and prohibit the use of such accounts in all bureau systems that support hydroelectric dams.
• Implement controls to ensure that ICS user accounts are removed when no longer needed.
• Implement controls to ensure that passwords are regularly changed.
• Establish procedures for additional background investigations as appropriate, based on a risk analysis of each employee’s role.

Bureau officials partially agreed with two recommendations concerning password security but disagreed with the other three. The IG considers all five unresolved and said it will forward the issues on to Interior’s Office of Policy, Management and Budget for further review.

The report is the first in a series of reviews the IG is conducting of the bureau’s hydroelectric cybersecurity.

Last week, the bureau awarded a $45 million contract to two companies for cybersecurity services for all 600 dams under its purview. Those services include the full spectrum of potential vulnerabilities, including ICS, as well as backend systems and continuous monitoring.