Cybersecurity in Water Sector: Stakeholders Perspective
Publication: Journal of Water Resources Planning and Management
Volume 147, Issue 8
Abstract
Cyberattacks on critical infrastructure systems are becoming a significant concern. Sabotage and destruction of critical infrastructures may cause devastating impacts on physical systems, economic security, public health, and safety. The water sector is one of the most critical infrastructures, and as such, identifying and managing cyber threats on the water sector’s facilities is crucial to providing a continuous and safe supply of water. This study reports on a stakeholder engagement process conducted in the form of an active workshop that aims to show different stakeholder’s perspective on cyber threats, knowledge gaps, and barriers to implementations of cybersecurity procedures and technologies in the water sector. The workshop, demonstrated on the Israeli water and cyber sectors, brought together 45 professionals from the water and cyber sectors (government, academia, utilities, consultants, and commercial suppliers). In the cybersecurity domain, many studies focused on developing algorithms, but only a few considered the organizational and policy aspects of the problem. The present study addresses this gap and presents an example demonstrating the importance of integrating stakeholder engagement into decision making in the water domain. The workshop’s findings are summarized and analyzed to highlight top priority activity areas and suggest required actions according to the stakeholders’ perspective, which can help shape the landscape of the water sector’s cybersecurity.
Get full access to this article
View all available purchase options and get full access to this article.
Data Availability Statement
All data, models, or codes that support the findings of this study are available from the corresponding author upon reasonable request.
Acknowledgments
This research was supported by the Centre for Cyber Law and Policy, the Minerva Centre for the Rule of Law under Extreme Conditions at the University of Haifa, the E.U. STOP-IT project, and the Grand Water Research Institute at the Technion.
References
Abokifa, A. A. Ha, K. Haddad, C. Lo, and P. Biswas. 2019. “Real-time identification of cyber-physical attacks on water distribution systems via machine learning–based anomaly detection techniques.” J. Water Resour. Plann. Manage. 145 (1): 04018089. https://doi.org/10.1061/(ASCE)WR.1943-5452.0001023.
Al-Qadi, D. 2020. “PIE index: Quantifying stakeholder engagement on urban water system projects and initiatives.” J. Water Resour. Plann. Manage. 146 (7): 04020043. https://doi.org/10.1061/(ASCE)WR.1943-5452.0001232.
America’s Water Infrastructure Act. 2018. “TITLE 1, Subtitle A (Sec. 113).” Accessed April 7, 2021. https://www.congress.gov/bill/115th-congress/senate-bill/3021.
Andersson, J. J., and A. Malm. 2006. “Public-private partnerships and the challenge of critical infrastructure protection.” In Vol. 2 of International CIIP handbook, 139–166. Zurich, CH: Center for Security Studies.
APM (Association for Project Management). 2019. “What is stakeholder engagement?” Accessed April 7, 2021. https://www.apm.org.uk/resources/find-a-resource/stakeholder-engagement/.
Auerswald, P., L. M. Branscomb, T. M. La Porte, and E. Michel-Kerjan. 2005. “The challenge of protecting critical infrastructure.” Issues Sci. Technol. 22 (1): 77–83.
AWWA (American Water Works Association). 2019a. “Cybersecurity risk & responsibility in the water sector.” Accessed April 7, 2021. https://www.awwa.org/Portals/0/AWWA/Government/AWWACybersecurityRiskandResponsibility.pdf?ver=2018-12-05-123319-013.
AWWA (American Water Works Association). 2019b. “2019 State of the Water Industry report.” Accessed April 7, 2021. https://www.awwa.org/Portals/0/AWWA/ETS/Resources/2019_STATE%20OF%20THE%20WATER%20INDUSTRY_post.pdf.
Ayalon, O., E. Elimelech, and M. Zerbib-Tsion. 2019. Feasibility of public-private partnerships (PPP) waste treatment facilities in Israel. [In Hebrew.] Haifa, Israel: Samuel Neaman Institute.
BRIDGE Energy Group. 2018. “BRIDGE Index™ utility industry grid operations survey.” Accessed January 9, 2018. https://www.bridgeenergygroup.com/news/press/bridge-energy-groups-2018-utility-industry-survey-grid-operations/.
Clark, R. M., S. Hakim, and S. Panguluri. 2018. “Protecting water and wastewater utilities from cyber-physical threats.” Water Environ. J. 32 (3): 384–391. https://doi.org/10.1111/wej.12340.
Curnin, S. 2018. “Collaboration in disasters: A cultural challenge for the utilities sector.” Util. Policy 54 (Oct): 78–85. https://doi.org/10.1016/j.jup.2018.08.002.
DCMS (UK Department for Digital, Culture, Media, and Sport). 2018. “Cyber security breaches survey, 2018.” Accessed April 7, 2021. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2018.
DEFRA (UK Department for Environment Food & Rural Affairs). 2017. “Water sector cyber security strategy. 2017-2021.” Accessed April 7, 2021. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/602379/water-sector-cyber-security-strategy-170322.pdf.
ESET. 2017. “State of cybersecurity in APAC: Small businesses, big threats.” Accessed April 7, 2021. https://cdn1-prodint.esetstatic.com/ESET/SG/whitepapers/State_of_Cybersecurity_in_APAC_-_Small_Businesses__Big_Threats.PDF.
Garmendia, E., and S. Stagl. 2010. “Public participation for sustainability and social learning: Concepts and lessons from three case studies in Europe.” Ecol. Econ. 69 (8): 1712–1722. https://doi.org/10.1016/j.ecolecon.2010.03.027.
Hall, D., E. Lobina, and P. Terhorst. 2013. “Re-municipalisation in the early twenty-first century: water in France and energy in Germany.” Int. Rev. Appl. Econ. 27 (2): 193–214. https://doi.org/10.1080/02692171.2012.754844.
Herrera, L. C., and O. Maennel. 2019. “A comprehensive instrument for identifying critical information infrastructure services.” Int. J. Crit. Infrastruct. Prot. 25 (Jun) 50–61. https://doi.org/10.1016/j.ijcip.2019.02.001.
Housh, M., and Z. Ohar. 2018. “Model-based approach for cyber-physical attack detection in water distribution systems.” Water Res. 139 (Aug): 132–143. https://doi.org/10.1016/j.watres.2018.03.039.
ICS-CERT (Industrial Control Systems-Cyber Emergency Response Team). 2016. NCCIC/ICS-CERT year in review: F.Y. 2015. Washington, DC: ICS-CERT.
Jaatun, M. G., E. Albrechtsen, M. B. Line, I. A. Tøndel, and O. H. Longva. 2009. “A framework for incident response management in the petroleum industry.” Int. J. Crit. Infrastruct. Prot. 2 (1–2): 26–37. https://doi.org/10.1016/j.ijcip.2009.02.004.
Kadosh, N., A. Frid, and M. Housh. 2020. “Detecting cyber-physical attacks in water distribution systems: One-class classifier approach.” J. Water Resour. Plann. Manage. 146 (8): 04020060. https://doi.org/10.1061/(ASCE)WR.1943-5452.0001259.
Liebes, I., O. Ayalon, R. Steinmetz, R. van der Ploeg, and P. Hogeveen. 2018. “Electric vehicles charging infrastructure in Israel: Implementation policy and technical guidelines Haifa Israel: Samuel Neaman Institute, 2018.” Accessed April 7, 2021. https://www.neaman.org.il/EN/Electric-Vehicles-Charging-Infrastructure-in-Israel-Implementation-Policy-and-Technical-Guidelines.
Madnick, S., M. S. Jalali, M. Siegel, Y. Lee, D. Strong, R. Wang, W. H. Ang, V. Deng, and D. Mistree. 2017. “Measuring stakeholders’ perceptions of cybersecurity for renewable energy systems. In Vol. 10097 of Data analytics for renewable energy integration. DARE 2016. Lecture notes in computer science, edited by W. Woon, Z. Aung, O. Kramer, and S. Madnick. Cham, Switzerland: Springer.
Marin, P., S. Tal, J. Yeres, and K. B. Ringskog. 2017. Water management in Israel: Key Innovations and Lessons learned for water scarce countries. Washington, DC: World Bank.
Mott Lacroix, K. E., and S. B. Megdal. 2016. “Explore, synthesize, and repeat: Unraveling complex water management issues through the stakeholder engagement wheel.” Water 8 (4): 118. https://doi.org/10.3390/w8040118.
OECD (Organisation for Economic Co-operation and Development). 2015. Stakeholder engagement for inclusive water governance. Paris: OECD Publishing.
Rao, V. M., and R. A. Francis. 2015. “Critical review of cybersecurity protection procedures and practice in water distribution systems.” In Proc., IIE Annual Conf., 2019. Orlando, FL: Institute of Industrial and Systems Engineers.
Rasekh, A., A. Hassanzadeh, S. Mulchandani, S. Modi, and M. K. Banks. 2016. “Smart water networks and cyber security.” J. Water Resour. Plann. Manage. 142 (7): 01816004. https://doi.org/10.1061/(ASCE)WR.1943-5452.0000646.
Ritchie, J. 2003. “The applications of qualitative methods to social research.” Qual. Res. Pract. Guide Soc. Sci. Stud. Res. 24 (Feb): 24–46.
Ruiz-Villaverde, A., and M. A. García-Rubio. 2017. “Public participation in European water management: From theory to practice.” Water Resour. Manage. 31 (8): 2479–2495. https://doi.org/10.1007/s11269-016-1355-1.
Seppänen, H., P. Luokkala, Z. Zhang, P. Torkki, and K. Virrantaus. 2018. “2018 Critical infrastructure vulnerability—A method for identifying the infrastructure service failure interdependencies.” Int. J. Crit. Infrastruct. Prot. 25 (Sep): 25–38. https://doi.org/10.1016/j.ijcip.2018.05.002.
Slay, J., and M. Miller. 2008. “Lessons learned from the Maroochy water breach.” In Vol. 253 of Proc., Int. Conf. on Critical Infrastructure Protection, edited by E. Goetz and S. Shenoi. Boston: Springer.
Statistics Canada. 2019. “Canadian survey of cyber security and cybercrime.” Accessed April 7, 2021. https://www150.statcan.gc.ca/n1/pub/85-002-x/2019001/article/00006-eng.htm.
Taormina, R., S. Galelli, H. C. Douglas, N. O. Tippenhauer, E. Salomons, and A. Ostfeld. 2019. “A toolbox for assessing the impacts of cyber-physical attacks on water distribution systems.” Environ. Model. Software 112 (Feb): 46–51. https://doi.org/10.1016/j.envsoft.2018.11.008.
Timashev, S. A. 2019. “Cyber reliability, resilience, and safety of physical infrastructures.” In Vol. 481 of IOP conference series: Materials science and engineering. Bristol, UK: IOP Publishing.
UNCED/Rio Declaration on Environment and Development. 1992. “Report of the United Nations conference on environment and development.” Accessed April 7, 2021. https://www.un.org/en/development/desa/population/migration/generalassembly/docs/globalcompact/A_CONF.151_26_Vol.I_Declaration.pdf.
United Nations. 2019. “Sustainable development goals.” Accessed April 7, 2021. https://sustainabledevelopment.un.org/.
USEPA. 2018. “Water sector cybersecurity brief for states.” Accessed April 7, 2021. https://www.epa.gov/sites/production/files/2018-06/documents/cybersecurity_guide_for_states_final_0.pdf.
Water and Sewerage Corporations Act. 2001. “PART 2, Division 1 (of the ACT).” [In Hebrew.] Accessed April 7, 2021. https://www.nevo.co.il/law_html/Law01/235_079.htm.
Water Framework Directive. 2000. “Directive 2000/60/EC of the European Parliament and of the Council of 23 October 2000 establishing a framework for Community action in the field of water policy.” Accessed April 7, 2021. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32000L0060.
Information & Authors
Information
Published In
Journal of Water Resources Planning and Management
Volume 147 • Issue 8 • August 2021
Copyright
© 2021 American Society of Civil Engineers.
History
Received: Jun 12, 2020
Accepted: Feb 1, 2021
Published online: May 18, 2021
Published in print: Aug 1, 2021
Discussion open until: Oct 18, 2021
Authors
Metrics & Citations
Metrics
Citations
Download citation
If you have the appropriate software installed, you can download article citation data to the citation manager of your choice. Simply select your manager software from the list below and click Download.