Why the water industry needs to boost its cybersecurity maturity

Legacy technologies reaching end-of-life, increasing investments in digitisation and automation, and the growing prevalence and sophistication of cybercrime are creating a melting pot of risk for water utilities, says Marc Wren, OT Cyber Security Manager at Ax Cloud & Cybersecurity.

Ensuring the reliability and safety of water supply to homes and businesses are at the core of every water utility’s operations. However, these principles are coming increasingly under threat from the digital world.

The number of cyberattacks around the world is increasing year on year, with attackers finding increasingly sophisticated ways to wreak havoc. Along with manufacturers, transport providers, and energy companies, water utilities are a common target.

On Monday 19^th August, South Staffordshire Water, which controls the water supply of around 1.6 million people confirmed it had been the victim of a ransomware gang attack. While the attack seems to have been focused on the IT network, the gang claimed that it had accessed the OT (operational technology) network, specifically the systems that monitor the levels of chemicals in the water.

During the current drought conditions across the UK, the water utility staff will be working extremely hard to maintain a safe supply and this attack will have certainly inhibited their ability to focus on this.

Other attacks on water utilities hit the news in April 2020 when cybercriminals attempted to raise the level of chlorine at five Israeli Water Authority facilities and in February 2021 when a hacker attempted to increase the sodium hydroxide in a municipal water supply in Florida, USA, to dangerously high levels.

A multitude of challenges

Due to age, many facilities run on legacy technologies, designed for efficiency over security. At the same time, new investments in digitisation and automation, including the industrial internet of things (IIoT) and hyperconnectivity of systems for remote access or analytics, are creating new and greater surfaces for attack. While these produce fantastic opportunities for efficiency, they need to be installed with a security-first approach.

Mindsets towards industrial cybersecurity and the protection of operational technologies are changing, but water utilities are juggling many priorities to address the risks alongside other investments they need to make amid a staff and skills shortage.

Current operations staff often face the challenge of maintaining system uptime, while implementing complex design changes and upgrades, which leaves little time to focus on asset and vulnerability management.

Others may have policies in place to superficially fulfil the requirements of the 2018 NIS (Security of Network & Information Systems) directive but lack the people capable of maintaining and actioning them

Help is on hand

OT cybersecurity is most effective when paired with a deep understanding of the process and control systems. As the UK’s largest automation company – via the Actemium brand – and a major player in ICT – via Ax – VINCI Energies UK & RoI is uniquely positioned to help water utilities in the UK protect the safety of their assets and customers.

We work with water and wastewater companies to assess the impact of a potential cyberattack on their OT and implement cybersecurity measures in a phased way, according to the budget and risk level.

Cybersecurity is simplest when designed into an OT system from the start, but we also support customers to successfully implement robust cybersecurity into existing water systems and treatment processes. The most important thing is to have visibility and monitoring in place, we can understand what is going on within the network and what needs to be protected.

In either case, the technical solution is only part of the equation. An overhaul of company procedures may also be required, creating good governance and enforcing policies to support the technical controls.

We can supply an OT cybersecurity officer on demand to put legislation into layman’s terms or provide a complete managed service to fill gaps in both staff capability and capacity.

Wherever you are in your cybersecurity journey – from audit, risk assessment, and developing good governance, to design and commissioning of cybersecurity defences – speak to us and we can help you take advantage of the latest efficiency-boosting digital technologies, while keeping your operations running safely and reliably.

For a free 30 minute consultation with a Ax security professional, please contact ot@ax.co.uk.  

About Ax UK

Ax UK is a technology services partner that delivers transformative solutions to accelerate your ambitions in today’s ever-changing world. Whether you need tried-and-tested platforms or cutting-edge innovation, we commit to customer excellence and invest in long-term thinking.  

The strength of Ax’ global network as part of VINCI Energies means you can rely on our incredible people to deploy technology that achieves critical operational outcomes, wherever you are and whatever your need. Learn more about VINCI here.