22.1 Facility Security, Vulnerability Assessment & Cybersecurity
Key Takeaways
- Physical security uses layered deterrence, detection, delay, and response, and no single measure substitutes for the others.
- Water and wastewater systems are designated critical infrastructure, and operators are expected to recognize and report tampering and suspicious activity.
- Control networks must be segmented from business networks, and no PLC or HMI should be directly reachable from the internet.
- Default credentials, unpatched remote access software, and shared passwords are the most commonly exploited weaknesses in utility control systems.
- Offline backups of PLC programs and HMI configurations, plus a practiced manual operating procedure, are what allow a utility to recover from a control system compromise.
22.1 Facility Security, Vulnerability Assessment & Cybersecurity
Water and wastewater systems are federally designated critical infrastructure. The Need-to-Know Criteria reflect this with tasks including "secure facilities to protect public safety and the water supply," "investigate system tampering," "perform facility and perimeter security," and "perform cyber security according to industry standards."
Layered Physical Security
Effective security is built in layers, each performing a different function:
| Layer | Function | Examples |
|---|---|---|
| Deter | Discourage an attempt | Fencing, lighting, signage, visible cameras |
| Detect | Recognize an attempt | Intrusion alarms, cameras, hatch switches, patrols |
| Delay | Slow an intruder long enough for response | Locks, hardened doors, vehicle barriers, ladder guards |
| Respond | Intervene | Alarm callout, law enforcement, on-call staff |
[!IMPORTANT] A camera that no one monitors is neither detection nor response — it is only after-the-fact documentation. Layers must connect: an intrusion alarm that dials out to an on-call operator with a defined response procedure is worth more than a large investment in cameras with no one watching. Assess security by asking what happens in the minutes after an alarm, not by counting devices.
Critical Assets to Protect
| Asset | Concern |
|---|---|
| Source water, wells, intakes | Direct contamination access |
| Treatment plant | Process disruption, chemical release |
| Chemical storage | Theft for misuse, sabotage, deliberate release |
| Storage tanks and reservoirs | Contamination; hatches are the vulnerability |
| Pump stations and remote sites | Often unattended and isolated |
| SCADA and control systems | Remote manipulation of the process |
| Records and drawings | System schematics are sensitive information |
| Backflow assemblies and copper | Routine theft targets with real operational consequences |
Storage tank hatches deserve particular attention. A hatch that can be opened is direct, unmonitored access to finished water serving thousands of people, which is why locked, gasketed hatches with intrusion switches reporting to SCADA are standard practice.
Access Control
Keyed locks are the baseline, but key control is where most programs fail — keys accumulate with former employees and contractors, and no one knows how many exist. Card or fob access solves this by allowing individual credentials to be revoked instantly and by producing an access log. Visitor sign-in, escort requirements, contractor badging, and prompt credential termination at separation are the accompanying administrative controls.
Tampering Investigation
Operators are expected to recognize and act on evidence of tampering: cut or damaged fencing, forced hatches and doors, pried valve boxes, unexplained equipment operation or setpoint changes, unfamiliar vehicles or persons at remote sites, and unexplained water quality anomalies.
Response: do not disturb the scene, document with photographs, notify supervision and law enforcement, evaluate whether water quality may have been affected, sample if warranted, and treat it as a possible contamination threat under the utility's escalation framework until it can be dismissed.
Risk and Resilience Assessment
Under AWIA Section 2013, community water systems serving more than 3,300 people must assess risk from both malevolent acts and natural hazards across:
- Physical barriers
- Source water
- Treatment, storage, and distribution infrastructure
- Electronic, computer, and automated systems
- Monitoring practices
- Financial infrastructure
- Chemical storage, handling, and use
- Operation and maintenance
The assessment is certified to EPA and drives the emergency response plan. Risk is evaluated as the combination of threat likelihood, vulnerability, and consequence, which is why a low-likelihood event with catastrophic consequence can still rank above a frequent nuisance.
Cybersecurity for Control Systems
Water and wastewater utilities have been targeted in real incidents, including intrusions that manipulated chemical feed setpoints. The threat is not hypothetical, and the vulnerabilities exploited have been mundane.
The Fundamentals
| Control | Detail |
|---|---|
| Network segmentation | Separate the control network from the business network with a firewall; no direct path between office email and a PLC |
| No direct internet exposure | No PLC, RTU, or HMI reachable from the public internet. Internet-exposed control devices are found routinely by automated scanning |
| Remote access control | VPN with multifactor authentication; no shared accounts; disable remote access software that is not actively needed |
| Credential management | Change default passwords on every device; unique credentials per user; no shared passwords; revoke access immediately at separation |
| Patching | A managed schedule, tested before deployment on control systems |
| Least privilege | Users and applications get only the access their role requires |
| Removable media control | USB drives are a documented infection vector into isolated networks |
| Logging and monitoring | Record access and configuration changes; review them |
| Backups | Offline, tested backups of PLC programs, HMI configurations, and historian data |
| Incident response | A cyber incident annex to the emergency response plan, with reporting to CISA and the state |
| Training | Phishing awareness is the highest-return security training a utility can provide |
[!WARNING] The vulnerabilities exploited in real water utility incidents have been basic: internet-exposed remote access software, unchanged default passwords, shared credentials, and accounts belonging to former employees that were never disabled. Sophisticated attacks make headlines, but ordinary hygiene prevents the majority of real incidents. A shared password taped inside a control panel door is a genuine and common finding.
The Manual Operating Requirement
[!IMPORTANT] Every utility must be able to operate manually. If the control system is compromised, disconnected, or simply untrustworthy, the plant must still deliver safe water. That means documented manual operating procedures, operators trained and periodically practiced in using them, local control capability that does not depend on the network, and the physical means to run the process from the field. This is the ultimate cyber resilience control, and unlike most security measures it also pays for itself the next time a lightning strike takes out a radio path.
Sector resources include the Water Information Sharing and Analysis Center (WaterISAC), CISA advisories and free vulnerability scanning services, and EPA cybersecurity assessment tools and technical assistance.
A utility installs eight new security cameras at its treatment plant but has no monitoring station and no alarm callout. What is the principal limitation?
Which set of weaknesses has most commonly been exploited in actual intrusions into water utility control systems?
Why is a documented and practiced manual operating procedure considered the ultimate cybersecurity control for a treatment plant?