Research Project: Securing Critical Water Infrastructure
CRITICAL INFRASTRUCTURE · OT SECURITY · CYBER RESILIENCE · NATIONAL SECURITY
About the Research
The security and availability of water infrastructure are fundamental to public health, economic stability, and national security. As drinking water and wastewater systems become increasingly dependent on interconnected technologies, industrial control systems, and remote operational capabilities, their exposure to cybersecurity threats continues to grow.
This research examines cybersecurity vulnerabilities and systemic risks affecting critical water infrastructure, with particular emphasis on small and under-resourced utilities that may lack the financial, technical, and operational resources necessary to defend against sophisticated cyber threats.
Building upon practical cybersecurity efforts with DEF CON Franklin, a volunteer initiative connecting cybersecurity professionals with vulnerable critical infrastructure operators, this project investigates how technical expertise, collaborative security assessments, and accessible cybersecurity practices can strengthen the resilience of essential water systems.
A central focus of this research is identifying common vulnerabilities and security deficiencies across otherwise diverse water utilities. Although individual facilities differ in size, architecture, operational processes, and available resources, many encounter similar challenges involving legacy technologies, insecure remote access, limited network visibility, insufficient segmentation, and constrained cybersecurity staffing.
Rather than treating every water system as an entirely unique security challenge, this research explores opportunities to identify repeatable patterns of risk and develop scalable, cost-effective security measures applicable across a broad range of operational environments.
The research additionally considers the national security implications of attacks against water infrastructure, including potential disruptions to drinking water availability, wastewater treatment, public health, and other interdependent critical infrastructure sectors.
Through applied research, security assessments, and the evaluation of practical mitigation strategies, this effort seeks to bridge the gap between established cybersecurity frameworks and the operational realities of the organizations responsible for delivering essential services.
The ultimate objective is to advance practical, scalable cybersecurity solutions that enable even the smallest water utilities to strengthen their defenses, maintain operational resilience, and protect the communities that depend on them.
Next Steps for Further Research
The next phase of this research will focus on identifying recurring cybersecurity weaknesses across water and wastewater utilities, evaluating the effectiveness of resource-conscious security interventions, and developing repeatable approaches to improving the resilience of critical water infrastructure.
Primary areas of investigation include:
Common Vulnerabilities Across Water Utilities: Examine recurring cybersecurity weaknesses in drinking water and wastewater systems, including insecure remote access, authentication deficiencies, legacy equipment, insufficient asset visibility, and weaknesses in operational technology environments. Determine which risks are broadly shared across facilities and which require system-specific solutions.
Operational Technology and Industrial Control System Security: Investigate the cybersecurity challenges associated with supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), human-machine interfaces (HMIs), and interconnected IT/OT environments. Evaluate how vulnerabilities in these technologies could affect treatment processes, system reliability, and operational safety.
Scalable Cybersecurity Controls for Under-Resourced Utilities: Identify affordable, achievable security measures that can be implemented regardless of organizational size or cybersecurity maturity. Assess the effectiveness of foundational controls such as asset inventories, network segmentation, secure remote access, access management, monitoring, backups, and incident response procedures.
Volunteer-Based Cybersecurity and Public-Private Collaboration: Building upon the DEF CON Franklin model, investigate how volunteer cybersecurity professionals, industry partners, and community organizations can provide sustainable security assistance to under-resourced infrastructure operators. Evaluate the effectiveness, scalability, and long-term impact of volunteer-supported cybersecurity programs.
Cyber-Physical Risk and National Security: Examine how adversarial activity targeting water infrastructure could affect operational integrity, drinking water quality, service availability, and public confidence. Investigate the cascading consequences of water system disruptions for healthcare, emergency services, agriculture, and other essential sectors.
Measuring Cybersecurity Improvement: Develop a methodology for evaluating the effectiveness of security interventions through baseline assessments, control implementation, and follow-up measurements. Identify practical indicators of improvement, including reduced exposure, improved asset visibility, strengthened access controls, and enhanced incident response readiness.
Cybersecurity Governance and Policy Development: Evaluate existing federal guidance, industry standards, and cybersecurity frameworks to identify gaps between recommended security practices and implementation capabilities. Develop recommendations for improving cybersecurity accessibility, resource allocation, and long-term infrastructure resilience.