Q&A: Water system cybersecurity threats and vulnerabilities | The Grainger College of Engineering

What is the difference between small, rural towns and larger city municipalities?

Large municipalities operate very advanced utilities. One of the main challenges is to provide equal security across the water distribution system because of the spatial footprint and complexity. A distributed attack or an attack at a gateway node in the water system network could be potentially very damaging as the impact can cascade across the network. It’s very hard to monitor and control what’s going on everywhere with many points of potential failure.

Small towns operate simple centralized facilities with short distribution systems.  Monitoring is more straightforward in a small town where people are less anonymous compared to a big city, with extremely long distribution systems serving large populations, and where monitoring for bad actors and controlling access is very difficult.

“These systems are in some ways, living systems. They live with the people that live in the town, and how that town is growing or shrinking and evolving, those systems are evolving with it.”

What would be the impact of an attack on the community?

The immediate concern would be access to water quantity. Depending on the type of attack, if it’s an attack on the water quality, then, of course you cannot use the water, or it could be treated locally at the point of use with special kits. If it’s a question of the quality, not quantity, or compromised treatment  systems, then point-of-use treatment technology (such as filters) can be a temporary solution. But for the first few days after an attack that compromises the suitability of water for public use, access to water would be very complicated.  This usually means a run to supermarkets to purchase water, which may run out of water very quickly. Therefore, utilities or the local government must plan to bring  and distribute water to the public, generally including health care facilities, until other solutions are in place.

If it’s a major break in infrastructure, like failing control valves or pump stations, it would be a very similar problem. Even if the breakdown is very localized, it takes time to fix. For the people that are downstream of the point of failure, there would have to be a very similar sort of response and the need to make safe potable water available right away.

A most important implication is the timescale. How long does it take to fix?  If the cause of failure is mechanical,  then it is possible to diagnose the problem and fix it. Likewise for treatment systems if the problem is tied to unknown chemicals or bioagents, then this becomes a much more challenging problem from detection to attribution to mitigation and control.

If water is not available beyond a few days or a week, the economic implications are huge. Most industries depend on huge volumes of water to produce everything from computers to clothes. It’s not just about tap water, it’s the whole economic system that depends on water availability.