Submersible Solutions
Cybersecurity in Water & Wastewater SCADA Systems
Modernizing cybersecurity measures may be a necessary step to ensure critical resources remain safe.
Jeremy Drinkwine | SWPA
Image credit: The KonG - stock.adobe.com
Supervisory control and data acquisition (SCADA) systems are the unsung heroes of water and wastewater infrastructure, diligently overseeing tank levels, managing chemical dosing and controlling pump stations—all from a remote location. However, as these once-isolated systems increasingly connect to corporate networks and the internet, they transform into prime targets for cybercriminals. Ensuring the security of water SCADA systems transcends the realm of IT; it is a crucial commitment to public health and environmental safety.
Evolving Vulnerabilities in SCADA Systems
Traditionally, SCADA systems operated under the mindset of “security through obscurity,” relying on proprietary protocols and physical isolation (think air-gapping) to keep hackers at bay. But as the demand for real-time data and remote capabilities grows, so too do the vulnerabilities.
- Aging infrastructure: Many utilities still depend on controllers that are decades old and lack essential encryption and authentication features.
- Interconnected systems: The merging of corporate IT networks and industrial operation technology (OT) networks opens doors for malware to slip in undetected.
- Widespread protocol vulnerabilities: Commonly used, standardized protocols like Modbus and DNP3 leave the door ajar for attackers, allowing even basic network sniffing tools to read or inject harmful commands.
- Insecure remote access: Third-party vendors often connect via insecure remote desktop solutions or cellular modems, creating vulnerabilities that could be exploited.
The High Stakes of a Cyber Breach
The repercussions of a successful cyberattack on a water or wastewater utility can be catastrophic for entire communities.
- Water contamination: Malevolent alterations to chemical treatment parameters can threaten the safety of drinking water.
- Service interruptions: Disruptions at pump stations can cut off water delivery to homes, hospitals and even fire hydrants when they are needed most.
- Environmental catastrophes: Breaches in wastewater SCADA systems could lead to disastrous sewage overflows in local waterways and neighborhoods.
- Equipment damage: Forcing pumps or valves to operate beyond their safety limits not only leads to serious breakdowns but can also result in expensive and lengthy repairs.
Strategies for Securing Networks
Protecting water utilities demands an in-depth strategy that combines technical controls, smart network architecture and continuous monitoring. Here are some key strategies:
- Network segmentation (the Purdue Model): It is essential to keep business networks separate from operational systems. Utilizing the Purdue Model ensures corporate email networks never directly interact with critical programmable logic controllers (PLCs). Implementing firewalls and demilitarized zones (DMZs) can effectively manage data flows between these segments.
- Enhanced access control: Weak and shared passwords are a hacker’s playground. Utilities should require strong, unique passwords for every operator and system. Multifactor authentication (MFA) should be nonnegotiable for all remote connections to ensure a single compromised credential does not endanger the entire system.
- Continuous monitoring and anomaly detection: Ordinary IT antivirus tools sometimes fall short in industrial settings. Investing in OT-specific intrusion detection systems (IDS) helps establish a baseline for normal operations. Any unusual activity—like a valve that opens unexpectedly or a controller that receives an out-of-the-ordinary command—can trigger alerts for immediate investigation.
- Thorough incident response planning: Cyber resilience hinges on effective response strategies, not just preventative measures. Utilities should maintain up-to-date offline backups of all SCADA configurations and PLC logic. Regular tabletop exercises will prepare staff to isolate compromised networks and transition to manual operations seamlessly during an attack.
As water and wastewater SCADA systems face a rising tide of threats, it is clear that modernizing security practices is no longer optional. By embracing proactive measures—like network segmentation, rigorous access controls and rapid response capabilities—it is possible to safeguard these critical systems and, in turn, protect the communities that rely on them. It is vital to invest in infrastructure and ensure it remains strong and secure for generations to come.
Submersible Solutions is produced by the Submersible Wastewater Pump Association to inform and educate in the design and operation of submersible wastewater pumping systems. For more information, visit pumpsandsystems.com/swpa.
Jeremy Drinkwine handles water and wastewater sales for Telemetry and Process Control (TPC). He is also an executive committee member for SWPA. For more information, visit tpcusa.com.
In This Issue
