The Office of the Inspector General of the U.S. Department of the Interior has completed its work evaluating the Bureau of Reclamation’s operational and technical practices for protecting hydropower dams categorized as critical infrastructure from emerging cyber threats.
The report released was the second part of a series, and this evaluation was limited to a Reclamation control system that provides monitoring, alarming and process control to ensure the safe and reliable operations of the water and power facilities for another dam.
The office determined that additional efforts on this project are not needed.
The office also said that its recommendations in the first report in this series, to improve Reclamation’s account management and personnel security practices, apply to all of Reclamation’s hydropower dams.
Key elements of the memo were redacted in the version that is publicly available. It did say, “Our review of network traffic did not identify any significant anomalies or indicators of compromise.” Additionally, “We did not identify malware or other indicators of compromise during our analysis of memory from 12 key … computers. We also found that the USBR has implemented controls to help prevent the introduction of malware infections from external media such as USB devices.”
The first report, issued in June, said USBR “operates five hydropower dams categorized as critical infrastructure by the U.S. Department of Homeland Security.” This evaluation focused on Reclamation’s operational and technical practices for protecting two of these dams and the related industrial control system (ICS) it relies on to remotely control operations, including generators, gates and outlet valves.
The office found the ICS was at low risk of compromise from external cyber threats but that USBR’s account management and personnel security practices put the ICS and the infrastructure it operates at high risk from insider threats.
Reclamation operates 53 hydroelectric power plants that annually generate, on average 40 billion kWh, about 15% of the hydropower in the U.S.