Water Industry Cyber Security Human Resources and Training Needs

Abstract

Cyber-attacks are a growing and persistent threat to water infrastructure, including drinking water and wastewater systems. Water infrastructure uses a number of technical control systems to manage and track infrastructure properties, including hardware and software, such as monitoring and data acquisition systems, process control systems, and other devices, such as programmable logic controllers, that control data gathering equipment and information technology. As these systems become more connected to corporate systems and the internet, security approaches are needed equally across both the control system and the corporate network infrastructure, as there are many potential entry points for cyber attackers to exploit to these systems. These cyber-attacks occur on water infrastructure worldwide and water providers, in order to reduce the risks, need to identify control system asset security vulnerabilities and design, build and maintain a security architecture proportionate to the risk. Human resources are fundamental to these cybersecurity systems and the required emerging job roles require industry specific definition. This paper provides definition on the roles and responsibilities for control system security governance, particularly from the perspective of skills and knowledge and training requirements with a view to addressing leading industry security standards for control systems and practices.

A Comprehensive Study on Cyber Attacks in Communication Networks in Water Purification and Distribution Plants: Challenges, Vulnerabilities, and Future Prospects

“…The human is the greatest point of vulnerability for an attacker. Usually, attackers use social engineering methods to enter the environment, and a social engineering attack is conducted via human factors such as employees, managers, and contractors, exploiting a person’s lack of education, greedy nature, or psychological issue [ 24 ].…”

“…Cybersecurity has developed a huge interest in the water industry and some educational programs have been offered [ 20 , 21 ]. This provoked great interest in the research environment [ 22 , 23 , 24 , 25 , 26 , 27 ], as earlier cybersecurity incidents may have provided insightful information that could be used to inform current cyber defense efforts, promoting investments and initiatives and increasing their applicability and efficiency. This calls for a thorough compilation and analysis of these instances, which is currently lacking.…”

The Identification of Cybersecurity Work Roles for the Water Sector in South Africa

“…The water sector has attempted to bridge the gap between operating and information technologies by overlapping these systems to reduce maintenance costs and optimise the control and monitoring systems. The potential for cyber threats has increased due to the overlapping of these systems, (Wei et al, 2010;Skiba, 2020). It is important to note that critical infrastructure, such as the water infrastructure, is vulnerable if the information technology systems are not technically well protected, (Cavelty, 2007;Germano, 2019).…”