Protecting Your Water System from Hackers 

image description

Paula Feldman

Account Director

image description

James Naylor

Treatment Engineer

image description

Trey Shanks

Environmental Scientist

The recent cyber assault of a Florida water treatment plant’s computer system underscores that strong cybersecurity infrastructure and training are essential for protecting water systems’ most vulnerable assets. 

The American Water Infrastructure Act of 2018 (AWIA) aims to help communities protect against just this type of threat — a cyberattack or water contamination — by requiring utilities to conduct a Risk and Resilience Assessment. (Small utilities should be undertaking those assessments now to meet a June 30, 2021, deadline; large and medium-size systems should already have completed theirs.) 

The Florida incident in Oldsmar, near Tampa, illustrates important lessons: 

Vigilant operators protect water systems and save lives, making training and awareness crucial. According to news reports, the water utility employee saw that his computer was being manipulated and alerted his employer, who notified law enforcement authorities. Through quick action, the operator was immediately able to reverse a malicious command by the hacker that had increased the sodium hydroxide added to the water. the observant operator’s actions prevented harm to the community’s water supply. 

Adequate protection requires multiple layers. Remote-access systems need to have safeguards, and the water treatment system requires redundancies and checkpoints for monitoring water quality before it is distributed to the public.  

Any size system can be a target. The Florida utility serves about 15,000 customers. No system should assume it is immune from risk. 

Resources about best practices are available. The water industry understands the threat cyber crime poses to critical infrastructure and has developed multiple tools to help guide managers and operators in strengthening their systems. Among them: 

Freese and Nichols has assisted dozens of utilities of all sizes in their AWIA Risk and Resilience Assessments. Please contact us to see how we can help you with securing your system to reduce the threat of a cyberattack.  

image description

Paula Feldman, PE leads Client Services in Georgia and is based in Duluth.

image description

James Naylor, PE, is our Water Treatment Discipline Leader for North Texas, West Texas and Oklahoma.

image description

Trey Shanks, CFM, IAM, leads Freese and Nichols’ Asset Management services. He is a Principal in our Fort Worth office.