Since You Asked is a reader-driven series that answers questions about our community. Have something you've always wondered about? Submit your question here.

GLASGOW, Ky. — Federal officials are warning water and wastewater utilities about recent cyberattacks that have disrupted operations at some facilities across the country.

In a July 30 public service announcement, the FBI and Environmental Protection Agency said utilities in at least seven states had reported cyber incidents since July 27. Some of the attacks degraded water operations, including causing loss of pressure and flooding.

The Kentucky Energy and Environment Cabinet confirmed that no Kentucky water systems were impacted by the attacks referenced in the FBI and EPA warning.

According to the FBI, malicious actors remotely accessed programmable logic controllers, devices used to monitor and control equipment, and changed their configurations, including IP addresses and passwords.

The changes resulted in the loss of monitoring and, in some cases, control functionality, according to a report from NPR.

With cybersecurity threats facing water systems across the country, what protections are in place to safeguard Barren County’s water infrastructure?

Since you asked, Barrenside asked Glasgow Water Company about its cybersecurity protocols and how the utility protects its systems from potential cyberattacks.

General Manager Joe Watson said GWC takes cybersecurity seriously and has voluntarily implemented safeguards that go beyond basic compliance requirements.

GWC operates two water treatment facilities in Barren County, including its primary plant near Barren River Lake in Lucas. The facility processes millions of gallons of water each day and supplies water to customers throughout the region.

GWC also operates a smaller treatment facility near Beaver Creek in Glasgow.

Those treatment operations rely on computerized systems to monitor and control equipment throughout the process.

The utility contracts with an independent third-party cybersecurity firm that conducts a customized assessment of GWC’s systems, practices and potential vulnerabilities each quarter, Watson said.

The assessments provide recommendations for continued improvement. GWC also maintains procedures for responding to security incidents and works with its technology partners to evaluate and strengthen its cybersecurity measures.

One of the utility’s key safeguards is the separation of its critical water-treatment operations from its primary business network.

“Critical water treatment operations are not connected to GWC’s primary business network and are designed to continue operating independently in the event of a cyber incident,” Watson said.

That separation is notable given the FBI and EPA’s recent warning, which recommends that utilities remove critical operational technology from direct internet exposure and maintain the ability to operate systems manually if an attack occurs.

GWC also continuously monitors and protects its networked systems using security technologies, according to Watson.

For security reasons, Watson said the utility does not publicly disclose specific details about its safeguards, monitoring methods or system configurations.

Watson said GWC considers its independent quarterly cybersecurity assessments and continued improvements to be important investments given the critical nature of water and wastewater infrastructure and the evolving threats facing public utilities.