Cyber security in the water sector will be a key focus at the Institution of Engineering and Technology’s (IET) Water: Operational Technology and Data conference taking place in April this year.
Announcing the conference, the IET said that the need to protect against cyber-attacks has never been more important to the water sector. Now water engineers can gain the latest information about what needs to be done at the popular industry event which is going from strength to strength.
Pearse Bradley, Head of Telemetry & Telecoms at Northern Ireland Water commented:
“The trend to new communication technologies has led the industry towards greater reliance on 3rd party solutions as opposed to in-house solutions.Use of the internet does make water utilities more vulnerable to cyber security breaches.”
Everyone, whether consumer or service provider, has seen a “digitisation” of how utilities are managed over the past decade – and it’s clear that the threats are rising as fast as the conveniences.
The recent statistic from Beaming that British firms were each subjected to an average of almost 230,000 cyber-attacks in 2016, with the average volume of attacks hitting individual company firewalls reaching 1,000 per day, is frightening. For the water industry, it’s apparent that preventing cyber breaches is an area that now needs to be at the forefront of its engineering strategy.
Interconnectivity: both threat and solution?
Simon Hall is the Water Sector lead at the newly opened National Cyber Security Centre, and believes that the threat, actors and vulnerabilities are common to many industries. However, it is the geographical distribution of water supply, including to remote locations, that poses specific challenges:
“Old operational technology solutions have been local in nature, and not interconnected. The newer systems that are now being deployed are much more interconnected to provide greater efficiency, flexibility and ease of use. The providers need to ensure that security is built in to these new (largely IP based) systems from the start.”
“Also, companies can buy good equipment and services, but you can’t necessarily buy good security. A great deal can, and has to be achieved by improving security culture, and security policies and processes. That means awareness and education programmes, and sound, enforceable policies around areas such as third party access, change management, privileges and protective monitoring. The good news is that much of this – the development of good policy, or user awareness for example – is not expensive.”
Charles Williams, Strategic Business Director, Sweco, thinks that the interconnectivity of water suppliers leaves it open to attack, but could also provide the solution:
“The water Industry has a wide area network of interconnected sites covering the whole of the country. Each of these is connected back to central master station system in each of the water companies to provide centralised monitoring, and consequently there are many potential routes available for cyber-attacks."
"Currently, there is a great deal of work being carried out to protect the OT infrastructure including the use of communication protocols such as WITS DNP3 that utilises Secure Authentication to minimise the risk of attack through this route.”
Pearse Bradley agrees:
“While greater bandwidth may be achieved through communication methods such as GPRS and 4G, there is an increased risk to utilities as there is greater reliance on the internet as the transport mechanism. However, utilities engaged in this area are ‘hardening’ their infrastructure to try and prevent and mitigate any such breaches.”
An opportunity for the industry to learn more
Practical cyber security solutions for the industry is just one of the topics that Williams, Bradley, Hall and many others will be discussing on 26 and 27 April, at the Institution of Engineering and Technology’s (IET) Water: Operational Technology and Data conference.
Regarded in the industry as the foremost UK conference for water engineers, the two days will cover the key technical developments that the industry needs to look out for over the coming 12 months.
Implementing the optimal communications strategy is another strand prominent in engineering strategy right now. Alistair Dean, Programme Manager ICA & Specialist Teams at Severn Trent Water, who will be speaking on Smart Networks, says:
“Smart Networks are reliant on reliable communications to provide real time data for network condition. Fortunately there are several different technologies – IPClear, DSL, GSM, GPRS, radio, satellite, etc. – which can be packaged into the overall solution, with key assets being monitored with fall back systems.”
“An ongoing requirement to replace and upgrade”
Another is making sure that the industry is prepared for the introduction of AMP6. Charles Williams again:
“As the industry becomes more reliant on the real time data from the sites to inform their asset management, there is an ongoing requirement to replace and upgrade the associated infrastructure, including telemetry, SCADA, site automation and control as well as instrumentation. This is to ensure that the infrastructure can provide the required data to a consistent quality.”
Unlike, other water sector events, the dedicated focus on operational technology infrastructure is a key differentiator for the IET conference. Charles Williams explains:
“The things that differentiate this conference from the rest are the fact that it is aimed at the Operational Technology infrastructure and the associated real time data and information it provides to improve the operational efficiency and customer service of the business as a whole.”
Simon Hall is particularly looking forward to the session on smart networks:
“We hear a lot about smart networks in an energy context, but I’m really looking forward to hearing from a major water sector player about how the future is looking, and what factors that smart networks will introduce in terms of security that will have to be considered.”
According to the smart networks speaker, Alistair Dean, the important industry update from the conference is all about the cyber. “Resilient data networks are reliant on secure connection to protect data and the integrity of our assets and the national infrastructure.”
Water: Operational Technology and Data takes place in Warwickshire on 26-27 April. For more information, visit www.theiet.org/water