Water is essential for life, health, and well-being. It is also vital for many economic and social activities, such as agriculture, industry, energy, and recreation. Water utilities are responsible for providing safe and reliable water services to millions of customers across the country. However, water utilities also face various threats and challenges that can compromise their operations and endanger public health and safety. One of these threats is cybersecurity.

Cybersecurity is the protection of information systems and networks from unauthorized access, use, modification, or destruction. Cybersecurity is important for water utilities because they rely on various information technologies (IT) and operational technologies (OT) to monitor and control their processes and equipment. These technologies include computers, software, sensors, actuators, controllers, communication devices, etc. that are connected to each other and to the internet.

Water Utilities Consequences of Cyberattacks

Cyberattacks are malicious attempts to disrupt, damage, or gain unauthorized access to these technologies. Cyberattacks can have serious consequences for water utilities and their customers, such as:

• Loss of service: Cyberattacks can cause water utilities to lose control over their processes and equipment, resulting in service interruptions or outages. For example, in February 2021, a     hacker breached the computer system of a water treatment plant in Florida and tried to increase the level of sodium hydroxide (lye) in the water supply¹. Fortunately, the operator noticed the anomaly and reversed the change before any harm was done.
• Compromised quality: Cyberattacks can affect the quality of the water that water utilities deliver to their customers, resulting in health risks or environmental impacts. For example, in April 2021, a cyberattack on a wastewater treatment plant in California caused a malfunction that released 50 million gallons of untreated sewage into the San Francisco Bay². The incident posed a threat to marine life and public health.
• Data breach: Cyberattacks can expose sensitive or confidential data that water utilities store or transmit, such as customer information, financial records, operational data, etc. For example, in December 2020, a ransomware attack on a water billing system in Texas encrypted the data and demanded payment for its release³. The attack affected more than 200,000 customers and disrupted the billing process.
• Reputational damage: Cyberattacks can damage the reputation and trust of water utilities among their customers, regulators, partners, and stakeholders. For example, in May 2021, a cyberattack on a major pipeline company in the US caused a temporary shutdown of its operations and triggered panic buying and fuel shortages in some regions⁴. The attack raised questions about the company’s cybersecurity practices and preparedness.

Common Water Utility Cybersecurity Measures

To prevent or mitigate these consequences, water utilities need to implement effective cybersecurity measures and practices. Some of these measures and practices include:

• Risk assessment: Water utilities need to identify and evaluate their cybersecurity risks and vulnerabilities based on their IT and OT systems, their assets, their processes, and their environment. They need to prioritize the most critical or likely risks and develop mitigation strategies and contingency plans.
• Security policies and procedures: Water utilities need to establish and enforce clear and consistent security policies and procedures that define the roles and responsibilities of their staff, contractors, vendors, and partners. They need to ensure that their security policies and procedures are aligned with the best practices and standards in the industry, such as the American Water Works Association (AWWA) Cybersecurity Guidance and Tool or the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Security awareness and training: Water utilities need to educate and train their staff, contractors, vendors, and partners on the importance of cybersecurity and the potential threats and impacts. They need to provide regular updates and reminders on the security policies and procedures, as well as the dos and don’ts of cybersecurity. They need to foster a culture of security awareness and accountability among their workforces.
• Security technologies and tools: Water utilities need to invest in and deploy appropriate security technologies and tools that can protect their IT and OT systems from cyberattacks. These technologies and tools include firewalls, antivirus software, encryption, authentication, backup, recovery, etc. They need to keep their security technologies and tools updated and tested regularly.
• Security monitoring and response: Water utilities need to monitor their IT and OT systems for any signs of cyberattacks or anomalies. They need to have a dedicated security team or service that can detect, analyze, report, and respond to any cyber incidents. They need to have a communication plan that can notify the relevant parties and authorities in case of a cyberattack. They need to have a recovery plan that can restore their normal operations as soon as possible.

Cybersecurity is a vital aspect of water utility operations. Water utilities need to take proactive steps to enhance their cybersecurity posture and resilience. By doing so, they can ensure the safety and reliability of their water services and protect the public health and well-being of their customers.

How SCADA Can Boost Cybersecurity for Companies

Cybersecurity is the protection of information systems and networks from unauthorized access, use, modification, or destruction. Cybersecurity is crucial for companies of all sizes and sectors, as cyberattacks can cause serious damage to their operations, reputation, data, and assets. However, cybersecurity is also a complex and challenging task that requires constant vigilance and adaptation.

SCADA stands for Supervisory Control and Data Acquisition. It is a type of process control system architecture that uses computers, networked data communications and graphical Human Machine Interfaces (HMIs) to enable high-level process supervisory management and control. SCADA systems are widely used in various industries, such as energy, oil and gas, water, power, transportation, manufacturing, etc., to monitor and control their processes and equipment.

How SCADA Helps with Cybersecurity Efforts

SCADA systems can help companies with their cybersecurity efforts by providing the following benefits:

• Visibility: SCADA systems can provide companies with a comprehensive and real-time view of their processes and equipment. They can collect and display various types of data, such as process variables, equipment status, production data, security and safety measures, etc. They can also generate reports or charts to help companies analyze and optimize their performance. By having visibility into their operations, companies can identify and address any potential issues or vulnerabilities before they become serious problems or threats.
• Control: SCADA systems can provide companies with a high level of control over their processes and equipment. They can enable companies to remotely or automatically adjust or manipulate their process parameters or equipment settings according to their needs or preferences. They can also enable companies to implement preventive or corrective actions in case of any anomalies or incidents. By having control over their operations, companies can reduce human errors or interventions that may compromise their security or efficiency.
• Integration: SCADA systems can provide companies with a seamless integration of their information technologies (IT) and operational technologies (OT). They can connect various devices and systems that are involved in their processes and equipment, such as sensors, actuators, controllers, computers, software, etc. They can also use various communication methods and protocols to transmit data and commands between these devices and systems. By integrating IT and OT, companies improve their compliance and compatibility that can enhance their security or functionality.
• Security: SCADA systems can provide companies with a range of security features and tools that can protect their IT and OT from cyberattacks. These features and tools include firewalls, antivirus software, encryption, authentication, backup, recovery, etc. They can also help companies comply with the relevant security standards and regulations, such as the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) or the International Organization for Standardization (ISO) 27001. By having security features and tools, companies can prevent or mitigate the impact of cyberattacks on their operations and data.

SCADA systems are powerful and versatile tools that can help companies with their cybersecurity efforts. They can provide utility companies with visibility, control, integration, and security of their processes and equipment. By using SCADA systems, companies can enhance their operational efficiency, quality, reliability, and resilience in the face of cyber threats.

1. epa.gov

2. awwa.org

3. waterisac.org

4. natlawreview.com

‍