Fact Pattern You are the newly hired cybersecurity risk manager for city of Wind

Fact Pattern
You are the newly hired cybersecurity risk manager for city of Windermere. Windermere is a college town, with a population of 125,000, during the school year and 75,000 in the summers. Windermere has three large hospitals–a world-renown children hospital, a veterans hospital, and a teaching hospital associated with Windermere University\’s medical school. Windermere owns a water treatment facility which provides drinking water to homes and businesses, including the University and the three hospitals. Windemere has experienced a cybersecurity incident and hired an outside forensic expert to investigate and prepare an incident report. Windemere\’s city council has asked you to write a forward looking post-incident report that puts the incident in perspective and recommending policies and procedures to reduce the risk and losses of future cybersecurity incidents involving the water treatment plant.
The Cybersecurity Incident
During the early morning hours of Monday morning, August 29, an operator at Windemere\’s water treatment facility noticed unusual network activity while completing a report on a work laptop.
The operator noticed what appeared to be unauthorized remote access by an unknown, unauthorized individual to the water treatment facility\’s industrial control systems (ICS). See NIST – Definition of \”Industrial Control Systems\”.
A few seconds later, the operator lost all ability to control the operating screen and noted the following: the mouse moving on the operating screen independently, making changes, performing unauthorized activities, and then exiting the system.
The operator noted complete loss of control of the system lasted for approximately 3-5 minutes.
During this loss of control, the operator observed the unknown actor attempt to increase the amount of sodium hydroxide in the water supply to dangerous levels.
Modern water systems are engineered with many safeguards to keep parameters within acceptable limits, including ensuring that operators are trained and licensed to carefully monitor drinking water treatment operations.
In this incident, the operator observed the unauthorized actor raise the NaOH dose setpoint from its normal setting of 100 parts-per-million (ppm) to 11,100ppm.
NaOH is a chemical often used in drinking water treatment used to adjust pH and alkalinity.
Although an important component of the drinking water treatment process, NaOH can be a hazardous chemical to water consumers if concentrations exist in excess of safe operating parameters.
The increase in the amount of chemical added to the water resulted in dangerous levels, making the water not fit for human consumption.
Upon observing the unauthorized activity, the operator took swift action, identified the incident, reported it to upper management, and was able to manually restore the system to normal operating conditions swiftly, with no ill effects on public health or safety.
The Forensic Expert\’s Report
Windemere hired an outside cybersecurity forensics expert to investigate. The expert\’s report included four key findings:
FIRST FINDING: A legitimate remote access software package, with access to the internet, had been installed on the operator\’s laptop.
The plant\’s chief engineer had authorized installation of the remote access software on laptops used by 20 senior operators and 5 outside contractors. The software allowed these 25 individuals to access the plant\’s network while working offsite.
The chief engineer considered requiring two-factor authentication for those using the remote access software, but decided against it given that Windemere is a relatively small municipality with a modest budget.
SECOND FINDING: Evidence of damaging code inserted into the footer of a WordPress-based site associated with a water infrastructure constructions company contracted to provide services to the municipality.
The expert surmised that the malicious code was active for months prior to the incident reported by the plant operator.
While the malicious code was live, the site interacted with computers from municipal water utility customers, state and local government agencies, various water industry-related private companies, and normal internet bot and website crawler traffic.
THIRD FINDING: Prior to the events of Monday morning, an unknown actor, likely separate from the hackers who put the malicious code on the website, was able to gather sensitive data including the operating system and CPU, browser-type, touchpoints, input methods, presence of a web camera, microphone, video card display, and adapter details, likely with the purpose of improving the botnet malware’s ability to impersonate legitimate web browser activity.
FOURTH FINDING: The malicious actor likely accessed the municipalities’ system by exploiting cybersecurity weaknesses including sharing of passwords between water management employees, use of an outdated Windows 7 operating system, and the use of desktop sharing software to gain unauthorized access to the system.
Your NIST Evaluation Report
Windemere\’s city council has asked you to write a 4-5 page NIST Evaluation Report.
The report should take into account:
The general facts about Windemere set forth in the first paragraph of the Fact Pattern.
The descriiption of the Cybersecurity Incident
The Forensic Expert\’s Report
In preparation for writing your report please read
The NIST Cybersecurity Framework Version 1.1.
Executive Summary – pp. v – vi
Framework Introduction – pp. 1-5.
Overview of the Framework.
Risk Management and the Cybersecurity Framework
Framework Basics: Framework Core – pp. 6-8
How to Use the Framework: Establishing or Improving a Cybersecurity Program – pp. 14-15
Appendix A: Framework Core – pp. 22-44.
Pay special attention to the first three columns:
Function (i.e. Core Function)
Category
Subcategory
Appendix B: Glossary – pp. 45-47
The American Water Works Association (AWWA) Process Control System Security Guidance for the Water Sector
Recommended Cybersecurity Practices – pp. 9-13
Recommended Cybersecurity Practices and Improvement Projects – pp. 16-21
Your report should discuss the NIST Cybersecurity Framework, as it applies to:
The general facts about Windemere set forth in the first paragraph of the Fact Pattern.
The descriiption of the Cybersecurity Incident
The Forensic Expert\’s Report
In particular, you should discuss the NIST Cybersecurity Framework\’s:
Identify Function
Category: Asset Management, and the Relevant Subcategories – pp. 24-25
Category: Risk Assessment, and the Relevant Subcategories – pp. 26-27
Category: Supply Chain Risk Management, and the Relevant Subcategories – pp. 28-29
Protect Function
Category: Identity Management, Authentication and Access Control, and the Relevant Subcategories – pp. 29-30
Detect Function
Category: Anomalies and Events, and the Relevant Subcategories – pp. 37-38
Category: Security Continuous Monitoring, and the Relevant Subcategories – pp. 38-39
Category: Detection Processes, and the Relevant Subcategories – p. 40
Respond Function
Category: Communications, and the Relevant Subcategories – p. 41
NOTE: Please use headings and subheading in your report, such as \”Identify Function – Category: Asset Management\” and \”Identify Function – Category: Risk Assessment,\” etc.
Please also incorporate the relevant Recommended Cybersecurity Practices from the American Water Works Association (AWWA) Process Control System Security Guidance for the Water Sector – pp. 9-12