The water sector is responsible for wastewater treatment processes in the United States. Sewage treatment for 75 percent of the population relies on publicly owned wastewater systems. This is essential for the public health and safety of our nation. According to the Cybersecurity and Infrastructure Security Agency (CISA), there are over 16,000 wastewater treatment facilities in the United States that are becoming increasingly at risk of cyberattacks on both their enterprise and operational technology. 

System Components 

PNNL has designed, engineered, and fabricated multiple scale models, known as platforms, that represent different critical infrastructure equipped with industrial control systems and supervisory control and data acquisition systems. 

PNNL’s wastewater treatment platform contains representative control system equipment commonly found within a typical U.S. wastewater treatment facility, such as the following: 

• Scaled models of physical components, such as mechanical pumps, valves, motors, and containers as well as bar screens, membranes, gas digesters, tubing, and process controllers to connect the unit operations to show the flow of water through a wastewater plant. 
• Cyber-dependent attackable control surfaces and programmable logic controllers. 

These components are all fully functional, and they can represent upset conditions that occur in real-world scenarios, such as tank overflow/depletion, steady state disruption, membrane dehydration, and death of anaerobic digester organisms (“bugs”). 

Impact

With the wastewater treatment system platform, CISA has the ability to conduct red-team/blue-team cyber exercises and training and promote awareness in the industry of various cyberattacks that could affect wastewater treatment system operations. These exercises allow government and industry analysts to search for artifacts of cyber-attacker tactics and actions within realistic infrastructures to practice using their tools, processes, and coordination to document the cyberattack timeline and communicate recommended mitigation measures. 

Other use cases for the wastewater treatment platform are operational technology capability evaluations, data set generation, and vulnerability, mitigation, and analytics research.