In a growing pattern of international cyber threats, South Dakota has found itself at the center of a recent cybersecurity scare. Last month, municipal water systems in dozens of communities across Minnesota and South Dakota fell victim to a coordinated cyberattack allegedly orchestrated by Iranian hackers. While North Dakota managed to evade this security breach, the implications for South Dakota were more immediate and profound.
Cybersecurity experts identified that the attacks targeted programmable logic controllers (PLCs)—devices critical for automating operations in water and wastewater systems. These intrusions were part of what is considered an expanding and intensifying cyber war between the United States and Iran.
The Cybersecurity and Infrastructure Security Agency has acknowledged the attacks, and federal investigators have pointed fingers at Iran as the likely perpetrator. The attacks have raised significant concerns over the vulnerability of South Dakota’s infrastructure, typically seen as less protected than larger cities with more robust security systems.
“These attacks highlight the urgent need for cybersecurity enhancements across smaller communities in South Dakota,” said a spokesperson from a state security agency. “It’s not just about responding to these threats when they happen, but about preventing them in the first place.”
South Dakota
The South Dakota government is aware of these risks and has been working diligently to fortify its municipal water systems against external threats. There is a particular focus on upgrading the cybersecurity protocols that govern PLC systems, learning lessons from Fargo, North Dakota, where officials reported that their systems’ safety remains uncompromised due to the different software employed and robust cybersecurity protocols.
Fargo’s approach to cybersecurity includes using the Purdue Model. This method segments critical operations from departments that require internet connectivity, effectively creating a strong firewall against cyber threats. Furthermore, Fargo relies on a multi-step verification process, which adds an additional layer of security for remote access to its systems.
These techniques are of increasing interest to South Dakota officials, who aim to replicate similar security layers across the state’s water facilities. The Dragos Community Defense Program, which offers free cybersecurity support to smaller water, electric, and natural gas providers, has been encouraged as a resource for smaller communities within the state, providing much-needed support without the hefty price tag.
“South Dakota is dedicated to ensuring the safety of our critical infrastructure,” said a representative from the state’s emergency management agency. “Utilizing available resources such as the Dragos Community Defense Program can help us bolster our defenses against such threats.”
Beyond the immediate threat, this high-profile cyberattack has reignited debates around federal support for local cybersecurity initiatives. While the Environmental Protection Agency (EPA) had initially mandated that all of the nation’s drinking water systems conduct cybersecurity checks, opposition from several states led to the rule not being enforced. South Dakota remains committed to following the EPA’s best practices despite the lack of a federal mandate.
As these cybersecurity challenges continue to unfold, South Dakota has taken proactive steps to safeguard its essential services and infrastructure. Yet, the understanding remains that cybersecurity is an ever-evolving field that requires constant vigilance and adaptation to new threats.
“There’s no room for complacency in cybersecurity,” concluded the state’s spokesperson. “We must continue to adapt and evolve, ensuring our water systems—and indeed all facets of our infrastructure—are protected against present and future threats.”
Cybersecurity and Infrastructure Security Agency
South Dakota’s proactive approach has set a benchmark for smaller states in safeguarding public utility systems. As the state continues to enhance its cybersecurity measures, the message is clear: persistent vigilance and evolving tactics are non-negotiable in the face of escalating cyber threats.
For more information on how communities can protect themselves from cyberattacks, citizens are encouraged to visit the Cybersecurity and Infrastructure Security Agency website or contact local representatives.