Cybersecurity Advisory: Microsoft Exchange Server Vulnerability

Cybersecurity Advisory:

Microsoft Exchange Server Vulnerability

 

The Maine CDC Drinking Water Program (DWP) has been advised that a cyber threat actor has recently exploited known vulnerabilities in an on-premise Microsoft Exchange server at a utility that provides water and electric services in a small city. The location of the incident has not been released. The Water Information Sharing and Analysis Center (WaterISAC) is encouraging all public water systems with an on-premise Microsoft Exchange server to immediately take steps to protect their network. This means updating the Microsoft product(s), or disconnecting the product(s) from the network until updated with the appropriate Microsoft patch.

If the vulnerability is left unmitigated, it may lead to a cyber hacker gaining full access to files, mailboxes, and credentials stored on the system. In addition to patching, the Cybersecurity and Infrastructure Security Agency (CISA) recommends that your organization leverage the CISA activity alert (AA21-062A) to examine systems for indicators of compromise (IOC) to detect evidence of malicious activity. This alert provides detailed information on the Microsoft Exchange server vulnerabilities, including how to mitigate them.

What does this mean for your Public Water System?

The DWP has been advised by CISA that some Information Technology (IT) vendors use Microsoft Exchange servers. The DWP suggests that Public Water Systems contact their IT specialist to inquire whether their system is vulnerable to attacks that target these servers. If your system has vulnerabilities related to a Microsoft Exchange server, please work with your IT specialist to implement remediation actions to address those vulnerabilities as soon as possible. These actions consist of: (1) installing the applicable security patches published by Microsoft and (2) analyzing the network to search for evidence of compromise.  Please refer to the CISA activity alert (AA21-062A) for specific details about searching for indicators of compromise and installing the appropriate patches. Public water systems without a Microsoft Exchange server at their facility (generally smaller systems) are not at risk for this type of attack.

The DWP continues to advise public water systems to be on alert for potential security breaches, including cybersecurity breaches, at least through the current calendar year. If you have (or may have) experienced an attack, please contact local law enforcement as soon as possible, and your DWP Public Water System Inspector as soon as you are able. And thank you for all you do 24/7 to provide safe drinking water in Maine.