SCADA Security: How Water and Wastewater Facilities Can Protect Against Cyber Attacks

Supervisory Control and Data Acquisition (SCADA) systems are extensive control systems that perform behind-the-scenes collecting sensor measurements and operational data, process the information, and relay control commands to equipment. SCADA systems control vital infrastructure around the work, and as such, are vulnerable to online threats from those who want to acquire confidential data or disrupt operations.

As SCADA systems have evolved into systems that can include standard PCs and operating systems, TCP/IP communications, and Internet access, the thread exposure has increased by linking SCADA networks to business networks. Threats can include malware like viruses, worms, Trojans, and spyware and could impact a SCADA system by corrupting data, disturbing communications, and installing unwanted back doors.

The following are ways to help prevent cyber attacks:

Repair Operating System Vulnerabilities
All the typical IT operating system vulnerabilities are also present in SCADA systems; however, a SCADA system does not allow for down-time or interruptions in service, which can cause updates to be delayed or ignored. It is essential that these vulnerabilities be exposed by system operators for IT staff and be optimized and repaired in a timely fashion.

Increase Encryption and Authentication
There are two open standards for SCADA communications that were developed to provide security through encryption and authentication: IEEE6189 suite, which secure SCADA equipment communication and IEC62351, which covers secure authentication for DNP3 communication. All standards should be adhered to in order to maintain security.

Follow Best Practices Regulations
There are many resources to help critical infrastructure SCADA systems enhance security - for example, the standard ISA99 - Industrial Automation and Control Systems Security, establishes best practices, technical reports, and related information to define procedures for securing systems. There are also government regulations, such as the North American Electric Reliability Corporation - Critical Infrastructure Protection standards known as NERC_CIP, which dictates that the standard requires all power plants and electric utility facilities to develop new cyber security systems and procedures in accordance with a three-year implementation plan.

Appropriate security measures help prevent disruption of service, process redirection, and manipulation of operational data that could result in disruption. It is essential that water and wastewater facilities are secure from threats, by following the standards and regulations to keep SCADA systems secure, coupled with following standard IT procedures to keep the operating system up-to-date. Additionally, facilities should thoroughly assess and evaluate their current system, review the facility, interview personnel for any internal security threats, and review and analyze vendor information. Security is a serious threat for water and wastewater facilities, particularly with the use of SCADA systems, and all existing and potential security systems should be reviewed to ensure the public's safety.

The original post can be read here.