1. CYBER SECURITY FOR WATER AND WASTEWATER UTILITIES
PRESENTED BY: DAVID A. CHANDA, PE

2. Cyber Security – A Hot Topic
NotPetya Cyberattack
2018 Thales Data Threat Report
“Tempting Cedar Spyware”
2017 Bullets – Recent Equifax data leak, Russian and Chinese Cyber Security Attacks and data breaches at various retailers and credit card companies

3. Implementation Origins
Early 2000’s – Risk Assessment Methodology for Water (RAM-W)
Required by US EPA, based on cybersecurity work by Sandia Labs
Threat and vulnerability assessments
Consequences
Risk assessment and emergency response plan
2010 AWWA Standard J100
Uses RAMCAPTM
Risk and resilience analysis and management
Identify vulnerabilities – threats, natural hazards
Methods to evaluate options for addressing weaknesses
Focus on significant threats
AWWA and Sandia National Labs shortly after the events of 9/11, the EPA undertook a program to improve security at water utilities across the US
AWWA developed the first voluntary consensus standard encompassing an all-hazards risk and resilience management process for use specifically by water and wastewater utilities. 
RAMCAP Provides guidance for calculating the probability of a specific natural hazard occurring at a given utility (i.e., earthquake, tornado, and hurricane)

4. New Jersey Requirements for Utilities
2016 BPU Utility Cyber Security Program (Docket No. AO )
Water Quality Accountability Act (NJSA 58:31-1 et seq)

5. Water Quality Accountability Act (NJSA 58:31-1 et seq)
Water purveyors with > 500 service connections and “internet connected controls system(s)”
Effective date: October 19, 2017
By February 16, 2018 develop a Cyber Security Program (Based on BPU requirements)
Cyber risk management responsibilities & accountabilities
Establish plans, policies, etc. to minimize cyber risk
Conduct risk assessments, implement controls to mitigate risks, maintain situational awareness, create and exercise incident response and recovery plans
New Jersey Office of Homeland Security is currently implementing a checklist to review what is considered and internet controlled system. Not fully live yeat
NJCCIC program not currently available to submit the cyber security plans.

6. 2018 WQAA Cyber Security Implementation
Provide a copy of program to NJ Cybersecurity and Communications Integration Cell (NJCCIC)
Due February 16, 2018
Join NJCCIC within 60 Days of developing the cybersecurity program
Cyber Security Program Requirements
Cyber Risk Management
Situational Awareness
Incident Reporting
Response and Recovery
Security Awareness & Training

7. Areas of Concern Customer Information Staff Information E-mail System
Operating Data
Operating Control
Cloud-Based Computing vs. On-site Hardware
Pathways for Cyberattack

8. Approaches for Handling Security
Equipment – Hardware & Software
Physical Security
Organization
Staff Training
Handling of Unsolicited Files
Passwords
Turning-off Equipment
Limiting Physical Access
Physical Security
Lock rooms/areas that house servers and phone equipment
Limit access to authorized personnel
Staff Training
Provide regular training for staff
Laws/Regulations
Utility company requirements
How to handle spam and other unwanted
Passwords
Complexity
Frequency of Changing
Best Practices
Access
Training
System Maintenance
Provide each employee with appropriate credentials to access systems and limit their access to subsystems
Compartmentalize your cyber information
Customer vs. Staff vs. Operations
Limit on-line access to parts of you system
Require very strong passwords
10 digits, upper and lower-case letters, numbers and symbols
Change them regularly
Provide regular training for staff about laws/regulations
New Equipment / Procedures
Maintain Security of Passwords
Vet and install programming updates and patches ASAP

9. Typical Network Infrastructure
Domain vs Workgroup challenges

10. Typical Network Infrastructure – Cont.

11. Typical Network Infrastructure – Cont.

12. Typical Organization Utility Manager/Director Financial Officer
Manages Cyber Security for Financial Systems
Financial Officer
IT Manager
Coordinates Cyber Security
Manages Operations of SCADA System
Superintendent
IT Specialist/Consultant
Coordinates Operations of Cyber Security
System Billing
Administrative Assistant

13. Monthly Requirements The IT specialist shall …………
Monitor internal and external sources of threat and vulnerability
Deliver critical alerts and notifications as they occur
Maintain Executive Reports from Firewall including:
Threat Identification
Threat Protection
Intrusion Detection
Response Taken
Recovery Steps
The IT Specialist shall monitor internal and external sources of threat and vulnerability and maintain executive reports generated from the existing Firewall. The IT Specialist should be able to send critical alerts/notifications as they occur. To keep staff up to date, the monthly executive report must describe the following:

14. Quarterly Requirements - Training
The IT specialist shall train…………
Staff with access for potential pathways of threats
New personnel
The IT specialist shall train on…………
Password management
Contain both upper- and lower-case letters (case sensitivity).
Contain one or more numerical digits.
Special characters, #, $ etc. can be included but are not required.
All passwords changed every 90 days
Recommended minimum of eight characters.
Training of staff that have access to devices vulnerable to cyber threats in the form of In-House sessions, notification alerts, or as the IT Specialist deems fit. Training of new personal pertaining to the companies critical inventory requirements. Staff should be trained to have the best practices on creating and changing passwords. All passwords throughout the workgroup peer to peer connections should meet the following requirements:

15. Quarterly Requirements – Training Cont.
Downloading unlicensed software.
Accessing files remotely should be through a secure remote access service (VPN).
Safe internet usage, recognize any cyberattacks and vulnerabilities, and avoid any suspicious s.
Trained to recognize a legitimate warning message or alert.
Employees should be trained to immediately report the incident so it can be investigated, and any threat reduced or removed.
Downloading unlicensed software should be prevented, unless instructed by the IT Specialist. The IT Specialist shall make available any anti-virus or malware application to the staff.

16. Long Term Requirements
Annual Requirements
Perform an annual inventory analysis of critical systems and document any changes from the system architecture as operated in the prior calendar year.
Review risk assessment methodology as encountered in the prior calendar year.
24 Month Requirements
Create a cyber risk assessment plan and conduct an exercise to the test the Plan every 24 months at a minimum.
Establish a Cyber Security Incident Response Plan that follows through the life-cycle of an incident.

17. Other Resources for Security Ideas
CSET – US Department of Homeland Security
Cyber Resilience Review (CRR)
Cyber Self Assessment
WaterISAC – Water Security Network
Organization of water sector professionals
Focuses on vulnerability and security of all types
New Jersey Office of Homeland Security and Preparedness
Currently Developing a checklist to determine “internet-connected control system” applicability.
WaterISAC Provide Tools for Water/Wastewater Utility Managers to identify and manage risks, help managers target limited resources where they are most needed, communicate threat warnings and incident reports to water systems.

18. Conclusions Cyber Security is an increasing threat to utilities
Legislation and regulations currently require higher levels of protection for utilities
Need for better protection will be extended to smaller systems, and possibly wastewater systems, over the coming years
Effective Cyber Security risk management has several elements
Organization
Situational Awareness
Incident Reporting
Response and Recovery
Security Awareness & Training
Start planning and developing your program ASAP
There is no down-side to proactively preparing and implementing these plans

19. QUESTIONS?
Presenter:
David A. Chanda, PE