Tenable: 90% of state CIOs rate attacks on critical SLED systems a high concern as AI widens attack surface
A Tenable blog post, the last in its Cybersecurity Awareness Month series, argues that state, local and education (SLED) organizations running critical infrastructure are prime targets because they are under-resourced. It cites the NASCIO/GDIT report "The Expanding Cyber Perimeter", in which nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern. The post says AI widens the attack surface in two ways: agencies adopt unsanctioned AI tools and AI-built apps faster than they can inventory them, and attackers use AI automation for faster reconnaissance. It recommends a whole-of-state security model that treats agencies, counties, cities, schools and utilities as one defensive perimeter. The post also promotes Tenable One.
Detalhes técnicos
- On July 30, the FBI and EPA warned that water and wastewater utilities in at least seven states had reported cyber attacks, in some cases degrading water operations.
- The same day, CISA reported a significant increase in threat actors targeting programmable logic controllers (PLCs) in the water sector. Actors modified passwords to lock out operators and changed PLC IP addresses to disconnect them, causing boil water notices and sustained manual operations.
- A week earlier, CISA and other federal agencies published a joint advisory on ongoing exploitation of internet-connected OT devices in the government, water and energy sectors.
- The NASCIO report finds that water and wastewater plants, dams, hospitals and transportation face the greatest risk. Many run aging or proprietary OT with no upgrade path and broad remote access.
- Attackers may breach weak local entities such as a small water utility, school district or dispatch center and move laterally toward larger targets.
- Compromised credentials and former-employee accounts are cited as an insider-type risk, and vendors quietly adding AI features and connectors can expand data access and permissions.
- The article names no CVEs, IOCs or threat actors.
Remediação
- Remove internet-exposed PLCs and set their mode switches to "Run"; secure remote access paths.
- Maintain a continuous inventory of critical assets, including OT, remote access paths and AI tools and apps.
- Prioritize exposures by exploitability and impact.
- Run regular access reviews and disable credentials promptly when staff leave.
- Share visibility and services across jurisdictions, and govern AI use with policies, approved-tool lists and training.
- Check whether State and Local Cybersecurity Grant Program (SLCGP) funding is still available.
Linha do tempo
-
Tenable: 90% of state CIOs rate attacks on critical SLED systems a high concern as AI widens attack surface
ler a análise desta fonte ocultar
A Tenable blog post, the last in its Cybersecurity Awareness Month series, argues that state, local and education (SLED) organizations running critical infrastructure are prime targets because they are under-resourced. It cites the NASCIO/GDIT report "The Expanding Cyber Perimeter", in which nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern. The post says AI widens the attack surface in two ways: agencies adopt unsanctioned AI tools and AI-built apps faster than they can inventory them, and attackers use AI automation for faster reconnaissance. It recommends a whole-of-state security model that treats agencies, counties, cities, schools and utilities as one defensive perimeter. The post also promotes Tenable One.
Technical Details
- On July 30, the FBI and EPA warned that water and wastewater utilities in at least seven states had reported cyber attacks, in some cases degrading water operations.
- The same day, CISA reported a significant increase in threat actors targeting programmable logic controllers (PLCs) in the water sector. Actors modified passwords to lock out operators and changed PLC IP addresses to disconnect them, causing boil water notices and sustained manual operations.
- A week earlier, CISA and other federal agencies published a joint advisory on ongoing exploitation of internet-connected OT devices in the government, water and energy sectors.
- The NASCIO report finds that water and wastewater plants, dams, hospitals and transportation face the greatest risk. Many run aging or proprietary OT with no upgrade path and broad remote access.
- Attackers may breach weak local entities such as a small water utility, school district or dispatch center and move laterally toward larger targets.
- Compromised credentials and former-employee accounts are cited as an insider-type risk, and vendors quietly adding AI features and connectors can expand data access and permissions.
- The article names no CVEs, IOCs or threat actors.
Remediation
- Remove internet-exposed PLCs and set their mode switches to "Run"; secure remote access paths.
- Maintain a continuous inventory of critical assets, including OT, remote access paths and AI tools and apps.
- Prioritize exposures by exploitability and impact.
- Run regular access reviews and disable credentials promptly when staff leave.
- Share visibility and services across jurisdictions, and govern AI use with policies, approved-tool lists and training.
- Check whether State and Local Cybersecurity Grant Program (SLCGP) funding is still available.