Security Issues and Best Practices for Water/Wastewater Facilities

Abstract

The security posture of most water/wastewater treatment plants is weak. The main reasons are that they were not designed to be secure against modern attack methodologies. Plant personnel are not properly educated on the who, what, why, when and how of facility and system security. Security by obscurity does not work for critical infrastructure. The potential for harm is too significant. Security for water/wastewater plants is minimized, un-funded, and not part of thinking. Security is not a core competency of most engineering, system integration and construction companies, nor of the operators and IT personal involved with these plants. A security incident at a water facility has not yet caused the financial burden or societal anxiety that motivates action. We tend to wait and react to incidents as opposed to being predictive and proactive. All infrastructure, including water and wastewater facilities, should be considered a target for any group or individual that may benefit from impacting the availability of the service as well as the confidentiality and integrity of the information and systems contained therein. This presentation will explore the motivation behind and the best practices for an appropriate security posture for a water/wastewater facility. It will look at security policies, vulnerabilities and risk management concerns and opportunities. It will explore the relationship between physical security and information security. Finally it will propose some ideas for developing prudent security policies given the vulnerabilities and risk and suggestions for implementing the appropriate technologies and practices to support the policies, standards and guidelines.