Spotlight on Cyber security
Municipalities and investor-owned utilities are taking proactive measures to enhance cyber-related aspects of water and wastewater security.
One driver of increased security scrutiny is government regulations. The most notable is Title IV of the Bioterrorism Act (Public Health Security and Bioterrorism Preparedness and Response Act) of 2002.
This act stipulates that each community water system conduct a vulnerability assessment of its system to a terrorist attack or other intentional act that disrupts the supply of drinking water, and prepare/revise and maintain an emergency response plan.
Physical security, including fences and perimeter security, guards, procedures and other similar measures, is one important focus and certainly the most visible to the average person. No less important are cyber security measures that ensure the integrity of an organization’s financial and/or operational information systems.
While no legislation currently exists regarding cyber security specifically for the water and wastewater industries, municipalities and investor-owned utilities are taking proactive measures to enhance this aspect of water and wastewater security.
Take, for example, the area of process monitoring and control. Over the last few years, the water and wastewater industries have increasingly turned to distributed control systems that go far beyond the basic definition of process control to ensure cleaner, safer water supplies, reduce environmental hazards and deliver significant operational cost savings. There are a variety of tools available to help assure the security of these control systems.
Among them are:
- Hardening, which disables unused ports and services. Because cyber attacks target ports and services, removing those that are not used (e-mail, for example) lowers the system’s profile, making it less vulnerable to attack;
- Anti-virus software, which protects the system from malicious programs spread by unsuspecting users; and
- Intrusion detection systems (IDS), which protect the system from cyber attacks from hackers and worms, which are viruses that reside in the active memory of a computer and duplicate themselves, potentially wreaking havoc.
Two important security concepts are: authentication, which identifies the user or host; and/or authorization, which dictates the actions a user and/or host can take. There are a number of approaches where these concepts can be used alone or, more effectively, in combination to discourage cyber attacks.
One security tactic is password management. The strength of passwords/PINS is based on their length and randomness. Unfortunately, the very thing that makes a password difficult to crack also makes it difficult for the user to remember.
This can be compounded by the need for different passwords to perform various activities or gain access to different programs, not to mention the necessity to periodically change passwords. A variation of password management is known as the challenge/response, in which computers must correctly respond to a question (similar to people using questions like “what was the name of your grade school?” or “who won the 2003 World Series?” to confirm someone’s identity) to gain access to the system.
Another related technique, so-called “smart cards,” which must be used to gain access to the system, also is gaining in popularity.
However, lost or misplaced cards not only limit the ability for personnel to do their job, but also pose a security concern themselves.
While it may sound like something out of a James Bond movie, biometrics, which read a user’s physical attributes, such as fingerprints, facial geometry or retinal signatures, will likely gain ground as the technology continues to improve and the social acceptability of these techniques become more accepted.
Another approach for authorizing users is known as Role Based Access Control (RBAC). In this approach, people are assigned to roles, and their authorization is based on the role.
In today’s work environment, people change positions and companies with more fr