Security Professionals Come Together in St. Louis

AWWA recently hosted its 2012 Water Security & Emergency Preparedness Conference in St. Louis, MO.  Participants from water and wastewater utilities, industry consultants and manufacturers, state primacy agencies, and Federal DHS and EPA came together to discuss the most pressing security and emergency preparedness issues facing the Water Sector today.

As a keynote speaker, Marty Edwards, Director of the U.S. Department of Homeland Security’s (DHS) Control Systems Security Program (CSSP), spoke about cyber threats to the water industry.  He noted that specialized embedded systems such as SCADA are integral components of all critical infrastructure sectors.  He went on to describe the greatest vulnerabilities and threats to industrial control systems.  Vulnerabilities ranged from the fact that many previously isolated proprietary systems have now been connected to the business’ intranet and that older non-cyber systems have been upgraded and are now highly cyber dependent to the continuing management mindset that equipment should last 20-30 years before needing to be updated.  Such vulnerabilities play into current threats that are as simple as hackers who compromise a system just to see if they can, to criminals looking for proprietary information, to advanced persistent threats from terrorist groups.  Edwards closed with a call for increased vigilance at all levels to protect the data and systems that keep the water flowing and safe to drink.

The Conference offered concurrent sessions across a wide range of security and emergency planning related topics.  Among them were the importance of water in emergency response/recovery; application of contamination incident characterization and decontamination strategies; control systems and cyber security; business continuity planning; and maintaining an all-hazards perspective in water sector preparedness.

During one session, AWWA’s Kevin Morley posed the question, “What if there is no water?” and went on to describe utility options and considerations in managing such a severe situation.  His mantra was “prepare for the effect – do not manage the cause.”  Morley explained that the bottom line for an effective response is to know and plan ahead for the types of disasters most likely to happen in the community.  This includes several core actions:  estimate the size of the potentially affected population and the duration of the event; identify at what point local capacity is likely to be exhausted; assess potable water alternatives; enumerate resources needed from regional/state/Federal sources and how they would be acquired/distributed; and establish a firm process to communicate requests up the chain.  Taking such planning steps can help a water utility be better prepared against any eventuality – from a local main break to a region-wide natural disaster.

John Whitler from EPA’s Water Security Division looked at another planning tool – a tabletop exercise on sharing resources across state lines.  Because of their extensive experience in hurricane response and recovery, several WARN (water and wastewater agency response network) programs from southeastern states met several months ago in Tallahassee, FL to discuss how effective interstate response to disasters could be managed and to work through the exercise.  They identified several key needs/justifications for interstate response:  proximity, geographic extent of a large disaster, and needs of large utilities with no proximate partners within their state boundaries.  Several interstate assistance options could be identified such as using an EMAC (emergency management assistance compacts) declaration, creation of utility to utility or municipality to municipality arrangements, or enabling legislation at the state or Federal level.  Whitler went on to explain that, while such efforts may be achievable on a smaller scale, a national interstate assistance effort may have limited applicability because of the diversity of state requirements.  Whitler closed by calling for continued dialogue on ways to enhance our collective response capabilities.

The Water Security & Emergency Preparedness Conference also offered many networking opportunities in addition to excellent sessions.  Participants were able to visit with nearly 40 exhibitors and continue “hot topic” discussions during breaks, a reception, and a planned luncheon.