Critical Cybersecurity for Safer Water Management

This white paper provides an analysis of data from a 2024 industrial control system/operating technology (ICS/OT) cybersecurity survey for the water sector, focusing on providing actionable strategies to protect water and wastewater critical engineering components, such as pumping stations, collection networks, treatment facilities, distribution systems, and digital control and monitoring systems, including central SCADA systems.

The paper emphasizes the importance of skilled ICS cybersecurity defenders and ICS-specific security controls aligning with the SANS Five ICS Cybersecurity Critical Controls.

By referencing real-world incidents and survey data insights, this white paper also identifies key challenges and overall cybersecurity guidance for water utilities to strengthen their ICS/OT cybersecurity programs.

Key insights from the survey:

• 39% of water facilities are unable to operate manually in an attack or are unsure of
• whether they can.
• 71% of water facilities have limited or no ICS/OT network monitoring capabilities.
• 26% of facilities reported having had at least one security incident in the past year.
• Only 58% of respondents have a dedicated ICS/OT incident response plan.
• Some reporting structures can lead to risks impacting water system operations and safety.