Spotlight Mar. 2021: Agencies Share Advice on Water System Cybersecurity

  • by ACWA Staff
  • Mar 19, 2021
  • Newsletters

Water system information systems managers have always made cybersecurity a top priority, with a recent incident in Florida showing why. 

During early February, someone remotely accessed a SCADA system within the community of Oldsmar’s water operations and attempted to massively increase the flow of sodium hydroxide to lethal levels. Fortunately, an employee intercepted the hack before it contaminated the water supply with the substance, also known as lye. 

A few factors made Oldsmar especially vulnerable. Its water operations relied on an outdated operating system and utilized an easily compromised remote access program intended for offsite troubleshooting. Nevertheless, the Florida cyberattack emphasized the need for constant vigilance within the nation’s water industry, prompting the FBI and other federal agencies to issue a joint cybersecurity advisory for water systems. 

Following the Florida incident, Western Municipal Water District distributed a news release that detailed its extensive commitment to safety and cybersecurity to reassure customers and regional stakeholders. Redundant protocols and constant monitoring of all information infrastructure play key roles at Western, among many cybersecurity measures at the district.

“Attacks that make the news are becoming increasingly sophisticated, and so cybersecurity protection will always need more and better tools to defend against these technology threats—it is a never-ending cycle,” stated Western’s Director of Administrative Services/Information Technology Greg Duecker, in an email. “Water agencies should consider cybersecurity as one of their major risks, prioritize efforts to safeguard systems, and include in their emergency planning efforts.”

Coachella Valley Water District Information Systems Director Luis Maciel made a similar point about the job of cybersecurity not getting any easier. The proliferation of new technology has made it easier to compromise systems without the necessity of being an expert, he said. However, the industry has responded on many levels. For example, newer SCADA systems employ multiple redundancies and built-in safety mechanisms, such as sensors that can react to compromises even in successful cyberattacks. 

“We keep cybersecurity in mind in every decision we make. For years, we have been aware that these incidents are prone to happen; thus, we are diligent about security every day,” Maciel said about the recent incident in Florida. 

However, some preventative measures are far more basic, and effective, than deploying complex technology.

“Cyber security starts with physical security, because a lot of times facilities themselves aren’t properly secured,” Maciel said. 

Federal law also addresses cybersecurity preparation through the American Water Infrastructure Act of 2018. It requires agencies develop a risk and resilience assessment and emergency response plan. However, water systems of any size are not alone when it comes to complying with the law or in overall efforts to maximize their cybersecurity. 

The Association of California Water Agencies Joint Powers Insurance Authority (ACWA JPIA) includes cybersecurity coverage as part of its membership package and has an extensive toolbox that can help members stay prepared. Other resources include the Municipal Information Systems Association of California, whose Board President is Hong Sae, Chief Information Officer for the City of Roseville.

“Government can best navigate the ever-changing cybersecurity environment with a regional and statewide collaborative approach,” Sae stated through an email.

Sae recommends agencies prioritize investment in three areas:

  • People: Embrace a “Security Is Everyone’s Business” approach that recognizes that every technology device is inter-connected into every aspect of our lives. Involve all security practices, demand to raise the level of awareness and training, respond to cybersecurity situations as quickly as possible and share the recovery efforts and lessons learned with others. 
  • Process: Align security practices to match standards such as those of the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). Address security gaps by continuously assessing benchmark maturity levels and your peers annually.
  • Technology: Many organizations struggle with too much data and not enough tools to protect it. Focus on security analytics and next-generation firewall and augmented intelligence programs to help detect and control cybersecurity incidents more effectively.

“Keep in mind that no one is completely secured, but with pre-active measurements, we can reduce the threat and minimize the impact,” Sae wrote.

Online Cybersecurity Resources

The following cybersecurity resources are available to agencies to find news, advice and updates to help keep their systems secure.

ACWA JPIA
www.acwajpia.com/services
Look for Cyber Security Resources

Municipal Information Systems Association of California
www.misac.org

California Office of Emergency Services
www.caloes.ca.gov
Look for Cybersecurity Integration Center under CalOES Divisions, Law Enforcement

Cybersecurity & Infrastructure Agency
www.cisa.gov/water-and-wastewater-systems-sector

FedRAMP and StateRAMP Cloud Services Security
www.fedramp.gov and www.stateramp.org 

Cyberhood Watch
www.cyberhoodwatch.com

Suggested Resources

15 RESOURCES prev next
Comment Letter: Draft Water and Wastewater Arrearage Payment Program Guidelines

Agency: State Water Resources Control Board Subject: : Comment Letter – Draft Water and Wastewater Arrearage Payment Program Guidelines Letter excerpt: […]

Federal Regulatory Issues Chart

Sorry, but only ACWA members have permission to view this content. Member login is required.

2021 Water Professionals Appreciation Week Toolkit

Sorry, but only ACWA members have permission to view this content. Member login is required.

Comment Letter: Draft Fund Expenditure Plan for Safe and Affordable Drinking Water Fund

Agency: State Water Resources Control Board Subject: : Comment Letter – Draft Fund Expenditure Plan for the Safe and Affordable […]

Water Efficiency and Conservation Polling Highlights

Sorry, but only ACWA members have permission to view this content. Member login is required.

ACWA Groundwater Management Policy Principles

In August 2021, ACWA released its updated “ACWA Groundwater Management Policy Principles.” The policy principles include enhancing local management of […]

Coalition Letter: Forestry Sector Economic Stimulus – Wildfire Trailer Bill

To: Senators Skinner and Wieckowski, and Assembly Members Ting and Bloom Subject: Forestry Sector Economic Stimulus – Wildfire Trailer Bill […]

Coalition Letter: Oppose Stormwater Draft Permit Proposal

Agency: State Water Resources Control Board Subject: We oppose stormwater Draft Permit Proposal that Would Lead to Massive Cost Increases and […]

Comment Letter: Proposed General Order for Restoration Projects

Agency: State Water Resources Control Board Subject: Proposed General Order for Restoration Projects Statewide Letter excerpt: ACWA appreciates and strongly supports […]

Comment Letter: ACWA Support for Infrastructure Investment in Jobs Act, Concerns with PFAS Amendment

To: Senator Dianne Feinstein and Senator Alex Padilla Subject: ACWA Support for Infrastructure Investment in Jobs Act, Concerns with PFAS Amendment […]

Comment Letter: Draft Emergency Curtailment and Regulation for Bay-Delta Watershed

Agency: State Water Resources Control Board Subject: ACWA Comments on 8/3/2021 Board Meeting – Item #5 – Draft Emergency Curtailment […]

Comment Letter: Support of Proposed Amendment to Rule 1470 and Proposed New Rule 118.1

To: Ms. Susan Nakamura, Assistant Deputy Executive Officer, South Coast Air Quality Management District Subject: Support of Proposed Amendment to […]

2021 PSPS Toolkit

Sorry, but only ACWA members have permission to view this content. Member login is required.

Comment Letter: Opposition to H.R. 2467, the PFAS Action Act of 2021

To: California Congressional Delegation Subject: Opposition to H.R. 2467, the PFAS Action Act of 2021 Letter excerpt: On behalf of […]

Comment Letter: Coronavirus State and Local Fiscal Recovery Funds Interim Final Rule

To: The Honorable Janet Yellen Subject: U.S. Department of Treasury’s Coronavirus State and Local Fiscal Recovery Funds Interim Final Rule; […]

Suggested News

15 Articles prev next
Sacramento-Area Water Use Down 6 Percent in August

Sacramento-area residents reduced their water use by 6 percent in August compared to the same month in 2020, according to […]

ACWA News Available for Sept. 17, 2021

Sorry, but only ACWA members have permission to view this content. Member login is required.

VID Receives Statewide Awards for Governance and Transparency

VISTA – Vista Irrigation District (district) has received two major statewide honors, the District of Distinction Platinum Recognition award and […]

Where Unity of Purpose Finds a Voice

During the past two months, I have enjoyed the privilege of personally meeting staff and leadership at several ACWA member […]

AWA Declares “Stage 1” Water Alert in Amador County

Under the newly declared Stage One – Water Alert, water customers may water lawns and gardens only between the hours […]

September Priority Issues Update Available

The September 2021 Priority Issues Update is now available online to members. The update is a summary of the latest […]

Save Our Water to Launch New Toolkit

Save Our Water will soon launch a new fall campaign focusing on ways Californian’s can reduce their water usage inside […]

BCVWD Named One of the Best Places to Work in the Country

BEAUMONT  – Beaumont-Cherry Valley Water District (BCVWD) is celebrating its highly coveted certification as a 2021 ‘Great Place to Work’ […]

WVWD Board Adopts Hazard Mitigation Plan

RIALTO — After months of review and approvals from federal and state agencies, the West Valley Water District (WVWD) Board […]

Upper District Opens Application Period for the Water Education Grant Program

MONROVIA – The Upper San Gabriel Valley Municipal Water District (Upper District) is pleased to announce the opening of the application […]

Upper District’s Board Activates Level 2 of its WSCP

The Board of Directors unanimously approved a resolution activating Level 2 of its Water Shortage Contingency Plan (WSCP). This level […]

PWD, City of Palmdale to Host Joint Water-Saving Workshop

PALMDALE – Palmdale Water District (PWD) and the City of Palmdale will host an informative workshop to encourage water conservation […]

San Juan Water District Supports Tobin for ACWA President

Water districts across the state are passing resolutions endorsing Pamela Tobin to be ACWA President for the 2022-’23 term. Tobin […]

Get a Peek behind the Scenes at EVMWD’s Virtual Open House

Elsinore Valley Municipal Water District (EVMWD) invites the community to join Flow into Fall, a virtual open house, on September […]

OCWD’s PFAS Pilot Project Receives Prestigious Award from CMUA

FOUNTAIN VALLEY – The Orange County Water District (OCWD; the District) has been named a California Municipal Utilities Association (CMUA) 2021 […]