Water and wastewater operations require extensive computer systems and remote access to keep them running smoothly. Expanded technology and connection through the internet of things make water delivery smarter than ever, but it comes at the cost of vulnerability to cyber-attacks. 

While the looming threat of hacker infiltration can be frightening, there are ways that water utilities can step up to defend against attacks and protect themselves from infiltration.

What is a cyber-attack, and how does cybersecurity work?

Cyber-attacks attempt to damage, disrupt, or gain unauthorized access to a computer, computer system or electronic communications network.

In a guide for water utilities entitled, “Cybersecurity Risk and Responsibility in the Water Sector,” the American Water Works Association (AWWA) lays out some of the ways that cybercriminals and hackers attack utilities:

  • Ransomware
  • Tampering with Industrial Control Systems (ICS)
  • Manipulating valve and flow operations
  • Altering the chemical treatment formulations

Cyber-attacks can leave lasting and costly damage to an operation’s infrastructure and harm consumers. One example mentioned in the AWWA guide was the City of Atlanta Department of Watershed Management after they were subject to a ransomware attack. It cost millions of dollars to recover data and fix infected systems. Cyber-attacks against smaller utilities can cripple their operations as they lack the resources to counter hackers.

Utility cybersecurity is a collection of defensive actions a utility takes to prevent cyber-attacks. Every utility should have some form of cybersecurity to defend against unauthorized access and recover if the system is compromised. Cybersecurity implementation is straightforward in theory but requires a lot of time and resources. Water management is one of the most under-resourced utilities in the U.S., usually being run by small teams of overworked staff.

For small utilities, it is becoming increasingly important for water and wastewater management to emphasize cybersecurity. 

The Importance of Cybersecurity for the Water and Wastewater Sector

Cybersecurity is a growing concern for utility companies of all types. While media attention has gravitated towards electric utility attacks, water management companies must be just as, if not more, vigilant. Here are some ways that utilities are working to keep their systems and data safe:

  • Using the “top-down approach is important for ensuring sustained effort in protecting the utility’s network and customer data. Leadership must buy-in to actively participate in and promote cybersecurity. If top decision-makers don’t commit, the company’s efforts will fall to the wayside.
  • Hiring or consulting with a security specialist who can assess, make suggestions on, and upgrade your current system is excellent if you are crunched for time.
  • Updating cybersecurity software that can block malware and unauthorized access. While most utilities have some security measures, hackers are sophisticated and always looking for, and finding, ways around security. It is important that all software be kept up to date to ensure the most recent thwarts to hackers are implemented.
  • Providing consistent employee training on the importance of cybersecurity, addressing simple cybersecurity issues and reporting suspicious activity is paramount to keeping a water and wastewater operation safe.
    • According to the AWWA, human error caused 90 percent of the water sector cyberattacks. Training can help prevent employees from leaving the virtual front door unlocked for hackers to exploit.
  • Creating a clear system layout can help to clear up confusion if an attack happens. As water operations grow, their networks grow more complicated, making it easier to make mistakes when compromised by cyber-attacks.
  • Implementation of standard guidelines like the AWWA, National Institute of Standards and Technology (NIST) and EPA can help get a utility to a baseline of security. 

Water sector segmentation makes it more difficult for universal standards across providers in the United States. This leaves it up to the individual utilities to ensure they follow through with protection protocols and a clean-up plan if they are compromised.

These attacks can compromise the cleanliness of the water and financial information of a utility’s customers. If the population can’t trust their water supplier to provide clean water, this can lead to a lack of confidence in the administration that can feed into other areas.

Consulting with a water and wastewater operations team that knows the importance of security and can implement measures to protect against damage is key to success. 

If you are looking for a team of experts in water and wastewater management, contact Alliance Water Resources. We’ve helped communities of all sizes steady their operations and become EPA compliant for present and future success.