6.6 Facility Security, SCADA Cybersecurity & Vulnerability Assessment

Facility Security, SCADA Cybersecurity & Vulnerability Assessment

The ABC criteria list "perform facility and perimeter security," "perform cyber security according to industry standards," and "conduct routine security checks" as job tasks, and the AWIA risk and resilience assessment expressly requires evaluating "electronic, computer, or other automated systems (including the security of such systems)."

---

1. Physical Security in Four Layers

Detection without a defined response is theatre. An alarm that sounds in an unstaffed building at 2 a.m. accomplishes nothing.

Site-specific hardening

• Wells and pump stations - locked, alarmed, vented securely, with sanitary well caps that are also tamper-resistant. These are usually the most remote and least visited assets.
• Storage tanks - locked and alarmed hatches, ladder guards or removable lower ladder sections, no climbable adjacent structures, fenced sites.
• Chemical storage and unloading - controlled access, supervised deliveries, and unique keyed fill connections (which is a security control as well as a safety control).
• Plant perimeter - continuous fence, controlled gates, clear zones, adequate lighting at entry points and around tanks.
• Buildings - controlled entry, visitor sign-in and escort, contractor management.

Access control and keys

• Individual credentials, not shared. Electronic access control provides an audit trail; a master key does not.
• Immediate revocation on separation. Every departure - resignation, termination, retirement, contractor demobilization - triggers key return, badge deactivation, and account deactivation on every system.
• Periodic audit of who has access to what, at least annually.

Insider threat

The most damaging water sector incidents have frequently involved current or former insiders with legitimate knowledge and, often, credentials that were never revoked. The controls are unglamorous: least-privilege access, separation of duties for high-consequence actions, prompt offboarding, and monitoring for unusual access patterns.

---

2. Why OT Is Not IT

Operational technology - the PLCs, RTUs, HMIs, historians, and instruments that run the plant - has different priorities from corporate IT.

That last row is the crux. Legacy industrial protocols were designed for isolated networks and generally do not authenticate commands. A device that can reach a PLC on such a protocol can command it. Security therefore has to come from controlling who can reach the network, not from the devices themselves.

---

3. The Controls That Actually Matter

1. Network segmentation - the highest-value control

• Separate the OT network from the corporate IT network and from the internet with firewalls.
• Use an industrial demilitarized zone (IDMZ) for any data that must cross - the historian replica, the reporting server - so that no session ever runs directly from the corporate network to a PLC.
• Segment further within OT by process area or site, so a compromise of one lift station RTU does not reach the plant.
• No PLC, HMI, or RTU should be directly reachable from the internet. Devices exposed on the public internet are found by search engines that index industrial protocols, and they are the most common initial access point in documented water sector incidents.

2. Remote access

• Encrypted VPN with multi-factor authentication, terminating in the IDMZ rather than on the OT network.
• Named individual accounts with least privilege; no shared logins.
• Vendor access on demand only - enabled for a defined window, monitored, and disabled afterward. Standing always-on vendor tunnels are a recurring finding.
• Session logging.

3. Credentials

• Change every default password on PLCs, HMIs, switches, radios, cameras, and analyzers - default credentials are published in the vendor manual and in every hacker reference.
• Unique passwords per device; a password manager, not a spreadsheet named "passwords."
• MFA everywhere it can be applied, especially remote access and administrative accounts.
• Deactivate accounts immediately on separation - the most cited water sector incident cause.

4. Asset inventory and patching

• You cannot protect what you have not inventoried. Maintain a list of every device, its firmware version, its network address, and its owner.
• Track vendor advisories; test patches on a bench or during a planned outage; where a device cannot be patched, compensate with segmentation and monitoring.

5. Backup and recovery

• Offline, tested backups of PLC programs, HMI configurations, historian data, and engineering workstations.
• Test the restore. A PLC program backup nobody has ever restored is a hope.
• Manual operating procedures - the plant must be able to run without SCADA. Write them, train on them, and drill them.

6. Monitoring and logging

• Log authentication, configuration changes, and firewall denies.
• Alarm on unexpected control actions: a valve that moved with no operator command, a setpoint that changed outside working hours, a pump start with no corresponding HMI action.
• Because OT traffic is highly repetitive, anomaly detection works unusually well here.

7. Training and phishing resistance

Most intrusions still start with a person. Annual training, phishing simulation, and a low-friction way to report a suspicious message do more than most technical controls.

---

4. Vulnerability Assessment

The AWIA risk and resilience assessment is a vulnerability assessment with a statutory name. Common methodologies include AWWA J100 (Risk and Resilience Management of Water and Wastewater Systems), VSAT (EPA's Vulnerability Self-Assessment Tool), and the AWWA Water Sector Cybersecurity Risk Management Guidance with its assessment tool.

The structure

1. Characterize assets - what exists, what it does, what depends on it.
2. Identify threats - malevolent acts (physical intrusion, chemical release, cyberattack, insider, contamination) and natural hazards (flood, hurricane, ice, earthquake, drought, wildfire).
3. Evaluate consequences - public health, service outage duration, economic, environmental, and reputational.
4. Assess vulnerability - how likely is a given threat to succeed against the current controls?
5. Estimate risk - consequence x vulnerability x threat likelihood.
6. Evaluate countermeasures and their risk reduction per dollar.
7. Prioritize and fund, and feed the result into the capital plan and the ERP.

Handle the product carefully. A completed vulnerability assessment is a roadmap of exactly how to hurt the utility. Control its distribution, mark it appropriately, do not email it broadly, and consider whether it is exempt from public records disclosure under applicable Virginia provisions.

---

5. Incident Reporting and Resources

Free resources Virginia utilities should be using: CISA's cyber hygiene vulnerability scanning, CISA regional cybersecurity advisors, EPA's water sector cybersecurity evaluation program, WaterISAC advisories, and the AWWA cybersecurity guidance and tool.

The blunt lesson from documented water sector cyber incidents: they have overwhelmingly exploited internet-exposed devices, unchanged default passwords, unpatched remote access software, and credentials belonging to former employees. These are not sophisticated attacks, and the defenses against them are neither expensive nor technically difficult. They are, however, easy to postpone - which is exactly why they get exploited.