The treatment processes for our potable water, which are essential for the protection of our nation’s public health and economic stability, are the responsibility of the water sector. The Cybersecurity and Infrastructure Security Agency (CISA) has identified that over 153,000 public drinking water systems in the United States are at an increasing risk of cyberattacks—both to their enterprise and operational technology. 

Water treatment systems are critical for our nation’s access to clean drinking water but are also relied upon by other critical infrastructures and systems. Clean water supply is essential for sanitation services, cooling systems, and agriculture as well as for emergency response and disaster relief operations such as firefighting. 

System Components

PNNL has designed, engineered, and fabricated multiple scale models, known as platforms, that represent different critical infrastructure equipped with industrial control systems and supervisory control and data acquisition systems. 

PNNL’s water treatment system platform contains representative control system equipment commonly found within a typical U.S. water treatment facility. Below are some examples: 

• Scaled models of physical components, including real pumps, valves, tanks, and sensors, as well as a water reservoir source, tanks that use air to simulate the ozonation process, LEDs that act as simulated ultraviolet light for disinfection, and a water distribution tower tank. 
• Cyber-dependent attackable control surfaces and programmable logic controllers. 

These components, all of which are fully operational, are capable of representing upset conditions that occur in the real world, including improper water treatment mixture/filtration, tank overflow, and operator loss of situational awareness.

Impact

The water treatment system platform helps to improve the industry’s awareness of various cyberattacks that could affect water treatment system operations by providing CISA with a means to conduct red-team/blue-team cyber exercises and training. These exercises allow government and industry analysts to search for artifacts of cyber-attacker tactics and actions within realistic infrastructures so that they can practice using their tools, processes, and coordination to document cyberattack timelines and share recommended strategies for mitigation. 

Other use cases for the water treatment system platform include operational technology capability evaluations, vulnerability assessments, mitigation and analytics research, and dataset generation.