Risk scenario / NIST CSF 2.0

Could Ransomware Stop Your Plant, Pipeline or Water System?

Harris Ejiofor, CISM – CyberShield Advisory

An illustrative scenario: ransomware on a small utility's office network spreads toward the systems that run operations. How it happens and what keeps service running.

This illustrative scenario is fictional. The organization and people described are invented.

The situation

Pine Ridge Water serves a small town and the farms around it. Eight people run everything: billing and customer service in the office, and two operators who watch the treatment plant and pump stations from a control room computer. Years ago a contractor connected the control room to the office network so operators could check email and the manager could see plant readings from her desk.

What happened

On a Monday morning the billing clerk could not open any files. A ransom note appeared on every office computer. Over the weekend, criminals who had bought a stolen password for the utility's remote-access service had signed in, spread across the office network and encrypted it.

Then the control room computer started behaving oddly. Because it sat on the same network, the operators could no longer trust what the screen showed them. The manager made the safe decision: disconnect the control room from everything and run the plant by hand. Operators drove to pump stations to read gauges and adjust settings in person, around the clock, for most of a week.

Water kept flowing, because the operators knew the manual procedures and had practised them. But billing stopped, customer calls went unanswered, and the town council wanted to know whether the water was safe.

Why it went this far

One password opened the door. The remote-access service did not ask for a second sign-in step.
Nothing separated the office from operations. The control room shared the office network, so a problem in one could reach the other.
Nobody knew everything that was connected. The contractor's old connections were not written down anywhere.
Backups sat on the same network and were encrypted along with everything else.

What helped

Operators had written manual procedures and had practised running the plant without the control computer.
The manager knew who to call: the state drinking water program, the utility's insurer and an incident response firm.
Paper copies of key contacts and procedures were in the control room.

What Pine Ridge changed

Separate networks for office and operations, with only the connections that are truly needed, written down and reviewed.
A second sign-in step for all remote access, and remote access to operations only through one controlled path.
Offline backups, tested by restoring them.
A short incident plan that includes running the plant manually, rehearsed once a year.

Questions for your organization

If your office computers were locked tomorrow, could your control systems keep running safely?
Can someone reach your operational systems with just a password?
When did your operators last practise running without the control computer?

Take the next step

Our free NIST CSF 2.0 assessment asks five quick questions about who owns security, where sensitive data lives, sign-in, incident plans and tested backups, and gives an indicative result. It is a short check, not a formal rating.