Engineering of Water Systems

Cybersecurity.

By Ed Butts, PE, CPI

This final installment of our series on the engineering of water systems is one I actually added after I began working on the columns because the topic of cybersecurity and prevention techniques can no longer be ignored.

One only has to look at the attempted attacks on water systems around the country in the late summer to understand the importance of cybersecurity today. So, let’s dive in and wrap up our series by examining the background, procedures, and prevention methods associated with providing adequate cybersecurity for water and wastewater control systems.

SCADA for Water and Wastewater Systems

Protecting a water and wastewater system from cyber threats largely requires a common-sense approach. Essentially, the threats you or your teenage children can conceive, so can others.

A Supervisory Control and Data Acquisition (SCADA) system is a control system that generally uses computers, networked data communication methods, and graphical user or other types of interfaces for high-low level process supervisory management and data acquisition. The system usually uses other peripheral analog or digital devices, such as programmable logic controllers (PLCs) and discrete PID controllers to interface with the actual process or pumping equipment.

Developing adequate error correction protocol, restricted SCADA access paths, and firewalls are important steps.

The operator interface enables monitoring parameters and collection of data and the issuing and adjustment of process commands, such as controller setpoint changes that are handled through the SCADA computer system or PLC. However, the real-time control logic or controller calculations are generally performed by networked input/output (I/O) modules which directly connect to the field sensors and motor controls.

The SCADA concept was developed as a universal means of providing remote access to a variety of local control modules, which can be from different manufacturers allowing access through standard and established automation protocols. Early versions of SCADA systems that tied together decentralized
facilities such as water pumping and distribution and wastewater collection systems often employed hardwire systems that used Frequency-Shift-Key (FSK) protocol designed to be open, robust, and easily operated and repaired, but not necessarily secure. Later control systems utilized proprietary systems such as Microcat made by Autocon, Healy-Ruff (Mini Pro), Allen-Bradley, or other firms.

The move from proprietary technologies to more standardized and open solutions together with the increased number of sensors and connections between SCADA systems, office networks and workstations, and the internet has made them more vulnerable to various types of network attacks that are relatively common in computer security protocol.

In practice, large SCADA systems have grown to become similar to distributed control systems in function by using multiple means of interfacing with a pumping plant or reservoir. They can control large-scale processes that can include multiple sites and operate well over large as well as short distances.

It is currently one of the most common types of industrial control systems and used extensively in industrial process systems such as oil and gas, electric power generation and distribution, and of course, water works. However, there are ongoing concerns about the vulnerability of SCADA systems to possible warfare/terrorism attacks, particularly when using radio, broadband internet (DSL), or cyber transmission.

Cybersecurity Risks

There are several potential risks to water systems using cyber technology that must first require identification of the cybersecurity-related risks based on a potential impact assessment. This should include, at a minimum:

• An assessment of all potential and open vulnerabilities, system attack modes, and entry points along with a defined approach to abate the critical risks identified. This may encompass enhanced technologies, error correction, firewalls, and new processes.
• Specific protection means for the most sensitive and critical water system assets by ensuring that the right organization, technology, and supervision techniques are in place to prevent any meaningful impact on water service continuity or quality of service provided to customers.
• Implementation of frequent third-party security audits, ratings, assessments, and appropriate patches and updates to further secure the operational control system and the overall water system it supports.

Developing adequate error correction protocol, restricted SCADA access paths, and firewalls are important steps.

For error correction and signal confirmation, many early versions of control systems utilized BCH codes (Bose–Chaudhuri–Hocquenghem codes), which form a class of cyclic error-correcting codes that are constructed using polynomials over a finite field. One of the key features of BCH codes is that during code design, there is a precise control over the number of symbol errors correctable by the code. In particular, it is possible to design binary BCH codes that can correct multiple bit errors.

Another advantage of using BCH codes is the ease with which they can be decoded on the receiving or transmitting end, namely via an algebraic method known as syndrome decoding. This simplifies the design of the decoder for these codes, using small low-power electronic hardware.

In many cases, SCADA users have mistakenly assumed that having a Virtual Private Network (VPN) offered adequate dprotection, unaware that security can be trivially bypassed with physical access to SCADA-related network jacks and switches.

Industrial control vendors suggest approaching SCADA security like information or data security with a defense in-depth strategy that leverages common Information Technology (IT) practices. Many vendors of SCADA and related control products are now fully involved or have begun to address the risks posed by unauthorized access by developing lines of specialized industrial firewall and VPN solutions for Transmission Control Protocol/Internet Protocol (TCP/IP)-based SCADA networks as well as external SCADA monitoring and data recording equipment.

Another common method of intrusion, malware, is rapidly spreading from existing and new IT systems to SCADA operations. Malware is any software intentionally designed to cause damage to a computer, server, or network. More cybercriminals are now able to remotely access industrial automation systems with malware due to accidental infections from more traditional office networks and IT systems, limited or outdated adoption of security firewalls, and other best practices in security for operational systems. Once hackers have access to the system, they can conduct malicious operations manually simply by understanding the different protocols that are commonly used within an operational environment.

The next type of potential intrusion prevention, an air gap, is essentially a myth. In an industrial environment, many organizations may believe their operational systems are protected because they’re not directly connected or tied to a network. In other words, they use what’s called an air gap, synonymous to that in a water system. However, they may unknowingly be tied to enterprise networks, such as the ERP system, which often uses some level of internet connectivity that thereafter exposes the computer to the potential corruption of the internet.

On average, industrial networks have 11 direct connections to enterprise networks, and in some extreme cases, the U.S. Department of Homeland Security has identified up to 250 connections. Even truly air-gapped systems are not totally safe as many have been attacked.

Finally, security through obscurity or anonymity is built around the idea that the complexity of an ICS [Internet Connection Sharing] protects the system from attacks. Many organizations believe they’re safe because their ICS isn’t connected to the internet or there is relatively little public knowledge about the way an ICS operates.

The increase in IoT-enabled attacks has proven that cybercriminals are much more sophisticated than many people believe. In order to prevent malicious hacking, intrusion, and possible system corruption for computer-based control systems using any type of radio, cellphone, broadband, or satellite transmission, SCADA and ICS planners and designers must incorporate a multi-pronged and tiered approach to security and rigorously control all remote access.

Cybersecurity Against Unauthorized Access

Beyond the basic security protocols associated with the method of transmission, it is generally best to assume that an experienced hacker will eventually enter the system’s overview screen, but it is still vital to set up the appropriate levels of firewalls, password-enabled entry, and sufficient security protocol to prevent further unauthorized access to control setpoints or operational parameters.

Figure 1. Recommended hierarchical access to SCADA systems.

Usually, the best way to prevent potential corruption of system control is provided by establishing a multi-level, stairstep means of access to the control system required to modify vital parameters or setpoints. Depending on the actual system and complexity, three to four progressive levels or steps of sophisticated password security are often warranted and needed to avoid possible severe cybersecurity breaches (Figure 1).

The initial level may allow basic access to the system overview screen and current operating conditions. This can be a valuable asset and PR tool for water systems that wish to provide real-time data to customers on common water system parameters such as a master overview of the water system with displayed flow rates, reservoir levels, and system pressure. In addition, other meaningful information, such as local weather data, road conditions, or river levels, when applicable, can be included.

The second available technology—if funds permit—is a separate level of access that is more secure than the first, allows monitoring access to each of the remote sites, but does not allow access to make remote setpoint changes or pump changes. The third, and most secure, remote access level can provide access to individual pump sites to make changes within the established operating program that could permit remote on-off replacement of a failed or inadequate pumping unit with a different operating unit within the normal setpoint parameters and operating system that controls the water system.

Finally, access to the operating system and parameter revisions should be reserved for those with privileged access or control. This should also be conducted by using an additional level of security to avoid possible unauthorized system access and the resulting risks that could occur from an experienced hacker.

In some cases, to provide an extra level of security, SCADA system designers and water systems may wish to incorporate a remote lockout that will automatically disconnect from and block the remote site from access and lock or freeze the system into a fail-safe operating mode to disregard any field changes should one or two failed attempts at access to the system occur. Reset to normal conditions could only be made through and at the master site within the fourth secured level of access.

In these situations, it may be better to have a reservoir overflow for a short time than drain to empty because a pump had been disabled. These considerations are important for all potable water systems, but critical for closed-loop systems that depend on full-time pump operation that may also not possess a great volume of stored water.

Cybersecurity Recommendations

In addition to the previous cited methods, several other recommended procedures can provide enhanced security for a water-related SCADA or ICS system:

1. Develop a cross-knowledgeable work group for the initial planning.

This involves assembling a group of people with separate and distinct areas of knowledge who can bring their specific expertise together to develop a workable and secure system. This should include those knowledgeable about the water system and how it functions, such as staff engineers, control systems engineers or designers, water system operators, and representatives of the SCADA system vendor or integrator.

2. Maintain updated software and patches.

This is critical to ensure the utility is using the most up-to-date software and patches that have addressed new malware and potential security breaches and incorporated the proper upgrades, firewalls, and security protocol.

3. Conduct an annual security audit and asset inventory update.

Many vendors are unaware as to which new assets or equipment they need to protect, such as PLCs, HMIs, and SCADA systems. Inventorying and categorizing assets based on common properties assists in understanding the data scope and attributes of each asset and helps vendors identify what they need to protect. Networked organizations also need to know how their assets are connected via networks to understand data paths. Mapping the enterprise’s network helps vendors identify how a hacker could gain access to data or controls.

In addition to an annual security audit, an updated inventory of assets should also be conducted at the same time. This should include a review of all sites, workstations, system interface devices, and HMIs to preclude any access by an unknown entity.

4. Develop a secure and isolated network.

In the simplest terms, this means that a water system control or SCADA system should not share a platform with the billing, word processing, or other ordinary computer uses or shared communication platforms. Resist the often-lower cost option of using cloud communication methods, particularly for control transmission, unless no other viable options are available. If utilizing a shared platform is revealed as the best or only option, ensure that the highest level of security and restricted access is obtained. The greatest level of computer isolation, firewalls, antivirus software, and multi-level password protection should also be used for optimum security.

5. Change and upgrade passwords regularly.

This is also a critical step, particularly for organizations or companies with a large turnover of employees or with shared password knowledge with many employees. Changing passwords when an employee with entry level authorization is discharged or resigns is recommended as an additional security step. Using passwords with random multiple letters, characters, capitalization, and numbers and not using short or easily guessed or ascertained passwords is also important.

6. Establish an ongoing relationship with an experienced and reliable SCADA systems integrator.

This may be one of the most important steps since most SCADA system designers and vendors are kept up to date on the most recent versions and current methods of hardware, communications, malware, security software, hackers’ tricks, and breaching methods necessary to aid in setting up a secure system. That said, current or proposed SCADA system vendors and suppliers using cybersecurity procedures need to be
formally assessed at least annually before selecting them for a partnership to ensure that they or their employees are not adversely impacting security.

7. Incorporate adequate firewalls.

The use of firewalls in a remote access computerized control system is generally considered to be an automatic necessity, but many are not utilized to their full potential, often due to operator issues with the system access rather than from potential hacking. Firewalls should be capable of inspecting packets while disregarding or blocking protocols that may attempt to reroute or corrupt data.

Effective firewalls will recognize the system’s communication method and protocol and allow communication while blocking any unauthorized or unrecognized communication to occur. Using leverage firewalls can admit proper communication between sites and devices while enforcing limited or no communication from alternate locations.

8. Utilize event monitoring and logging.

Regardless of the precautions used during a control system design, there will ultimately be specific events or possible intrusion attempts into or affecting the system. In order to track and develop a correction or protection plan from these occurrences, all abnormal events, anomalies, or intrusion attempts should be acknowledged, recorded, date/time stamped, and logged onto a permanent record.

9. Establish an independent backup control.

This is a critical aspect of an effective control system, whether an IoT, cloud, SCADA, or hardwired system. Inevitably, even the best control system, including remote transmission and data collection means, will fail, or at least hiccup enough to disrupt or discontinue transmission or service. All water systems must have some method of backup plan and controls, automatic or manual, that can be implemented to assume the most important functions of the control system and operate it for up to two weeks.

This can be in the form of water storage with manual treatment and pump operation capability, backup standby generators with independent control, or local control techniques that permit overriding or alternate control of the water system.

10. Resist the temptation to over-design.

Control sales personnel can be extremely charming and dutiful when it comes to selling a sophisticated control system, but the people charged with running and managing a water system must resist the temptation to buy into a complex or sophisticated control or graphics package or system that is well beyond their current ability or means to operate it.

11. Incorporate chemical feed and pump monitoring with lockouts for critical parameters.

Finally, should hacking and intrusion occur to a water system, it is imperative the hacker not be able to remotely modify chemical injection settings, feed rates, or pump operation. Remote access to pump control and injection rates of specific chemicals such as chlorine, caustic soda, and acids can seriously disrupt the process and possibly result in dangerously high or low feed rates or system pressures. This requires online process monitoring, control, and oversight of chemicals used in the water treatment train and ability to override unauthorized remote instructions and programming changes. If necessary, lockout and suspension to remote connections should be added.

12. Avoid the use of remote access.

Many utilities employ remote access to their SCADA or control system for monitoring or parameter changes using cellphones, iPads, or personal computers. Although this method is often convenient for the operator, the potential for unauthorized hacking and access to the program rises significantly. For this reason, I highly suggest remote access be limited to observance of operating conditions only, with changes
to the system operation, pressure setpoints, pump insertion or changes, or chemical feed rates reserved for the onsite master computer or controller. These changes should also be made using the highest password access.

______________________________________________

This concludes this series on electrical and control systems and this installment of The Water Works. Beginning with our column in the January 2027 issue, we will change gears and embark on a series of groundwater treatment processes and systems.

Until then, keep them pumping!

Ed Butts, PE, CPI, is the chief engineer at 4B Engineering & Consulting, Salem, Oregon. He has more than 40 years of experience in the water well business, specializing in engineering and business management. He was honored by the National Ground Water Association with the 2025 Technology Award. He can be reached at epbpe@juno.com.