Critical review of cybersecurity protection procedures and practice in water distribution systems

The objective of this paper is to conduct a critical review of cybersecurity procedures and practices in the water distribution sector. Specifically, this paper provides a characterization of the current state of cybersecurity practice and risk management in drinking water systems. This characterization is critically important due to the number of cyber attacks that have occurred against water systems recently. While organizations such as AWWA (American Water Works Association) have provided guidelines for implementing cybersecurity measures, limited formal research is being done in the field of risk analysis to assess the nature and impact of risks, and ways to mitigate them. Our work illuminates areas of concern: lack of detailed risk guidance and decision making strategies, and a need for a cost-benefit analysis to be performed. Addressing these will allow future research to address risks and decision making strategies. We believe this characterization is the next step towards developing a comprehensive risk assessment methodology that can identify cyber vulnerabilities and prioritize cyber measures in drinking water systems.