National Security Risk Analysis Community Meeting

When:  Feb 25, 2021 from 12:00 PM to 1:00 PM (ET)
Associated with  MORS Community

National Security Risk Analysis
25 February
1200 ET

Phone: +1 (646) 749-3122

Access Code: 415-074-061

Speaker: Dr. Kenneth Crowther will be presenting “Risk-base Cyber Security in the Water and Wastewater Industry.”


In the water and wastewater sector there has been a move towards digitization. Due to the broad distribution of water and wastewater treatment networks and the current aging infrastructure, there is a huge potential benefit of digital solutions. However, these benefits can be counteracted if these solutions are not secured sufficiently and appropriately. This presentation explores the threat landscape, threat actors, and solution horizon for cyber security in the water and wastewater sector. We provide an overview of cyber attacks against utilities in the water and wastewater sector, discuss the threat actors that are targeting critical infrastructure and the rate at which they are broadening their focus to include water and wastewater systems, and discuss the new hacking techniques that are emerging for exploiting industrial automation and controls systems. Using an open database that captures the hacking tactics and techniques of cyber adversaries (called the MITRE ATT&CK for Industrial Control Systems), we then provide a summary of the most likely tactics and techniques that will be used against water and wastewater industrial automation and control systems. These techniques provide a foundation to prioritize mitigation activities.


When evaluating how to implement high-priority mitigations, we realize that responsibility should be shared across stakeholders due to the comparative advantage of certain groups performing certain cyber tasks , including: vendors/product manufacturers, integrators, system operators, and system maintenance teams. We outline a partnership responsibility roadmap that covers the vendor during secure development, the integrator or system operator during secure deployment and installation commissioning, and the operator of the system, as well as addressing mitigations required for system upgrades and maintenance.


The results illustrate a risk-based approach to cybersecurity that accounts for the collaborative nature of implementation of technologies.


Dr. Kenneth Crowther is the Product Security Leader (PSL) for Xylem Applied Water Systems and Americas Commercial Team where he directs the implementation of cybersecurity into digital products and solutions for the water and wastewater sector. He was PSL for GE Global Research and Principal Engineer at MITRE. He teaches risk management at UVa and Georgetown, holds a PhD in Systems Engineering from UVa, and a BS in Chemical Engineering from BYU.


Elizabeth Marriott
(703) 933-9073