Perhaps because it’s often overlooked, but remains essential anyway, one of the process industries most concerned about cybersecurity is water/wastewater. For instance, many Chicago-area buildings are equipped with Metropolitan Industries’ domestically manufactured, water-boosting pumping systems, which are skids with pumps and panels that transport water to the top of structures. Just like most other skid-based equipment, their processes rely on numerous network connections, so they must respond to the cybersecurity vulnerabilities that come with those links.

Specializing exclusively in municipal, commercial and residential water/wastewater, Metropolitan is a 69-year-old, water/wastewater-focused, original equipment manufacturer (OEM), distributor and system integrator in Romeoville, Ill., and a member of the Control System Integrators Association (CSIA) (Figure 1).

“Cybersecurity continues to be a big issue in water/wastewater, so our controls and other equipment must have up-to-date cybersecurity protections,” says Tyler Miller, director of MetroCloud programming operations at Metropolitan. “We also provide a cloud-hosted SCADA service called MetroCloud for water/wastewater utilities, which monitors more than 1,200 installations in eight U.S. states. We developed it after noticing that most municipalities hosted their SCADA systems on a single desktop PC. This meant entire towns were relying on only one computer for critical water/wastewater functions, which meant they’d lose remote monitoring and alarming if and when it went down.”

Miller reports that most personnel at water/wastewater utilities are trained to use PLCs and SCADA systems. However, even though these devices add links and potential vulnerabilities, cybersecurity is still usually treated as an afterthought. Plus, when everyone started working remotely during the COVID-19 pandemic, they demanded even more connections and larger potential cyber-attack surfaces. At the same time, utilities would relay process or equipment alerts and alarms from their PLCs, but dispatching technicians to a problem’s location might take longer and be more difficult due to increasing retirements and fewer available staff for many basic tasks.

“People can’t be at their SCADA system or desktop PCs all the time,” explains Miller. “If a town or district has eight wells, then it also needs to manage their associated lift stations, tanks, meters and other equipment, and maintain them remotely without having to go back to their desktops all the time. This is where MetroCloud or another properly designed cloud platform can provide secure remote access and centralized monitoring without requiring the municipality to maintain all the supporting server infrastructure locally. This service can also help when there’s a gap between operations technology (OT) and information technology (IT). Many utilities still have legacy OT systems that need to remain operational for years, even as IT cybersecurity requirements and technology continue to evolve. A managed cloud platform can reduce some of that burden, while allowing utilities to modernize how operators access and manage their systems.”

Authenticate and assess

Likewise, Miller reports that Metropolitan has several recommendations for improving cybersecurity. These begin with two primary tasks. First, develop and use individual usernames and passwords, and change any previous default passwords. Second, evaluate existing equipment, setups, networks and their cybersecurity capabilities or need for them.

“Cybersecurity it’s all about keeping device and network protections updated,” says Miller. “A 30-year-old router or PC can’t be secured in the same ways as newer devices, and many can’t be secured at all. The problem is there are many 30-year-old PLCs still running out there, and once intruders get into one that’s networked, they can likely gain full lateral control, and access other unprotected networks and equipment.

Get your subscription to Control's tri-weekly newsletter.

“This is why users must separate their processes, segment their networks with industrial firewalls, and update them regularly. For instance, a typical water/wastewater treatment facility may be running seven or eight PLCs and associated HMI/SCADA. However, not all of those devices need to talk to each of the others. Consequently, segmentation should be designed around functional responsibilities, and allow only the bare minimum communications those devices and functions required to do each of their jobs. For example, if PLC B needs flow rate data from PLC A, then only that signal and parameter should be allowed.”

Third, beyond updating passwords and segmenting networks, Miller reports that each utility, company or organization’s staffers must be sufficiently trained and encouraged to make cybersecurity, Internet safety and hygiene a routine activity, just as they do with other high-priority tasks.

“Employees, managers and everyone else must be trained to not fall for phishing emails, and not to plug in unauthenticated flash drives,” explains Miller. “Many people still think that air gaps between controls, networks and other devices are good enough and will provide protection, but they won’t because there are always more attack vectors than they realize.”

For instance, Miller adds that one Chicago-area municipality told Metropolitan their security consisted of air gapping on their SCADA PCs. However, they also used TeamViewer remote desktop software on tablets to check operations data. Of course, the tablet PCs were able to reach the municipality’s SCADA server, which showed there was no air gap. In this case, the utility was relying on remote access software without the additional network protections that should be expected around access to critical control systems.

“This municipality also should not have had common usernames and passwords, and instead should’ve had unique logins,” adds Miller. “They also needed better-protected, remote computing, and a VPN with multi-factor authentications and zero-trust functions. This also shows why training is important because plant-floor operators often aren’t well-versed in which PLC is controlling what, what’s the disaster plan if one of them goes down, how to keep running, and how to recover. In addition to training, it’s important to create an incident-response and recovery plan that answers these questions, provides procedures that users can follow during an outage, shows how to isolate affected equipment, and keep production running manually.”

Routine training about using suitable passwords and defending against phishing attempts are crucial because even supposedly secure VPNs can’t protect a system if an attacker obtains valid user credentials, according to Miller. “Potential intruders can spoof coworkers’ identities in phishing emails—and even mimic their voices—when attempting to trick employees into disclosing their VPN credentials and authentications,” he says. “Once initial access is gained, most systems usually don’t have much internal network security to prevent hopping between nodes.”

This situation makes network segmentation even more important, and it’s why users need to adopt them in accordance with standards, such as the International Society of Automation’s (ISA) 112 for SCADA system design, ISA 62443 for network cybersecurity, and the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) 2.0.