As a vitally important activity, like healthcare, energy and electronic communications, the water sector is gradually deploying connected objects on the national network. A boon for fine-tuned resource management, but also a potential gateway for cyber-attacks. Identity and access protection, threats, strong authentication: how to secure water distribution and sanitation activities?
Water, an industry of vital importance
The distribution of water to households and businesses, as well as to agricultural and industrial activities, which consume a great deal of water, and its treatment, are sensitive sectors of activity. The aim is to ensure continuity of access to the resource, as well as public health safety.
In just a few years, to monitor reservoirs and tens of thousands of kilometres of pipelines, this sector of vital importance has deployed a whole range of connected objects: meters, of course, but also solutions for regular testing and measurement without human intervention. These sensors are able to communicate via digital networks, opening the door to a growing number of cyberthreats.
And there are already many examples around the world:
- In February 2021, the town of Oldsmar, Florida, was the target of a cyber-attack that could have had disastrous consequences for public health. Cybercriminals managed to break into the computer system of the city’s wastewater treatment plant, exploiting two vulnerabilities: the collection of TeamViewer login credentials shared by several employees, and the use of flaws in an obsolete Windows 7 operating system. The pirates were able to considerably increase the level of sodium hydroxide in the drinking water, making it extremely toxic. Luckily, the station’s teams reacted quickly and were able to regain control of the situation, averting a health catastrophe for the town’s 15,000 inhabitants.
- In December 2020, a group of Iranian attackers reportedly penetrated Israel’s water supply system. The HMI was directly connected to the Internet, with no security devices protecting it or limiting access. What’s more, the system did not use any authentication methods, which made it easy for attackers to log in and modify parameters such as water pressure and temperature.
Although Europe seems relatively unaffected at this stage, cyber-risks to water networks are very real.
The vulnerability of connected water networks
Communicating water networks, like all industrial process control systems (IPCS), have had to adapt to the end of the Public Switched Telephone Network (PSTN), which has led them to switch to new-generation networks based on IP technology. Faster, more reliable and easier to administer (automation, remote management, etc.,), they are also much more exposed to risk and vulnerable to cyber-attacks.
The question of safety is one that all managers of industrial systems wonder about. And this is even truer in the 12 sectors of activity recognized as being of vital importance (water, energy, transport, telecommunications, etc.), where each operator (known as Operators of Vital Importance) is legally required to comply with a certain number of cybersecurity obligations.
These requirements include:
- Drawing up and updating a list of its vital information systems;
- Inventory of third-party operators participating in the vital information systems, and taking the necessary measures to ensure that third-party operators comply with IS security obligations;
- Implementing ANSSI-defined security rules and ANSSI-qualified detection systems;
- Notifying security incidents and mandatory security checks;
- Implementing the measures laid down by ANSSI in the event of a major crisis.
Digital certificates: the key to security in the water sector
The granularity and dispersal of connected objects (sensors, probes and other automated devices) throughout water networks represents one of the biggest cybersecurity challenges facing the water distribution and treatment sector. Each of these objects is in fact a potential gateway to the information system, and an opening to malicious actions.
To limit the risks, it is essential to encrypt communications and secure identities and access to all IoT entities in water networks. The same goes for strong authentication of personnel to secure and trace interventions, whether they operate in situ or remotely. In all cases, this means implementing SSL / TLS X.509 digital certificates and automating their management to secure exchanges and access over the long term. For connected objects, this automation is possible thanks to the metadata associated with each object, which enables each of them to be precisely identified.
With the proliferation of digital certificates to secure communications, identify and authenticate users, applications and connected devices, the implementation of a solution for the supervision and management of the lifecycle of digital certificates (Certificate Lifecycle Management, CLM), such as BerryCert, is becoming essential. These tools make it easier to detect non-compliant, expiring or expired certificates, and automate their renewal or revocation. This makes access management and traceability easier and more secure, to limit the number of open doors on connected water networks over time.
