NCCoE project releases draft document for securing water and wastewater utilities, calls for feedback
November 3, 2022 – Published on Industrial Cyber
The National Cybersecurity Center of Excellence (NCCoE) published a draft project description seeking feedback from all stakeholders in the water and wastewater utilities sector. The NCCoE project is working to ensure that its guidance can benefit the broadest audience and is especially interested in hearing from water utilities of all sizes. The public comment period is open until Dec. 19, 2022.
The document titled “Securing Water and Wastewater Utilities: Cybersecurity for the Water and Wastewater Systems Sector,” outlines a project that will develop example cybersecurity solutions to protect the infrastructure in the operating environments of the water and wastewater systems (WWS) sector. The increasing adoption of network-enabled technologies by the sector merits development of best practices, guidance, and solutions to ensure that the cybersecurity posture of facilities is safeguarded.
The document identifies common scenarios across the WWS sector that may showcase higher-risk cybersecurity characteristics for WWS sector utilities. The scenarios are informed by the project team’s conversations with stakeholders across the WWS sector. The NCCoE project team will address each scenario in collaboration with members of the WWS sector and vendors of cybersecurity solutions. The resulting reference design will detail an approach that can be used by WWS sector organizations to plan for and mitigate cybersecurity risks.
Commenting on the NCCoE project document, Chris Warner, OT Cybersecurity Consultant, GuidePoint Security, wrote in an emailed statement that water systems are unique and challenging to secure because many systems are over 50 years old, and it will take tremendous financial and human resources to replace or upgrade to stay in compliance with regulatory entities. “Water SCADA systems have numerous physical sites that are diverse in architecture and challenging to ensure integrity and security for water treatment basins, distribution centers, storage towers/level management, drinking water distribution networks, real-time decentralized industrial wastewater treatment centers, and real-time flood control system monitoring,” he adds.
Read More HERE.