Vulnerability assessment a first step toward water system security

By Gordon T. Brookman, P.E., President, Environmental Risk Limited, and
Juval Aviv, President/CEO, Interfor, Inc.

April 29, 2002 -- The U.S. Environmental Protection Agency (EPA) has received supplemental appropriations from Congress to improve the safety and security of the nation's water supply.

The EPA is now soliciting grant applications from publicly owned drinking water utilities that serve populations over 100,000. The grant monies may be used to develop a vulnerability assessment, an emergency response/operating plan, security enhanced plans and designs, or a combination of these efforts. The EPA has clearly emphasized that the priority intent of the grant funding is to be applied towards vulnerability assessments.

Protecting the security of a water utility presents a number of potential vulnerability issues including the safety of the water source, pumping stations, water filtration process and the water distribution system. To determine the potential vulnerabilities and define the consequences, the water utilities need to develop a performance-based vulnerability assessment.

The performance-based vulnerability assessment has to address several key points including: how the water utility detects a problem, how it responds to a problem and how it can shut down and prevent further damage if its security is breached. A thorough assessment aims to evaluate the vulnerability of a particular system and develop measures to reduce the risks of attack and intrusion. It is comprised of on-site assessments of utilities and both daytime and after-hours walk-throughs of plants. Training sessions and on-going education for personnel is another critical element of the assessment program.

Another aspect of security deals with process chemicals and/or the potential to introduce chemicals into the water system. Chemicals used to purify the water could also become a hazard if the security of the water facility is breached. How large a hazard and how many people are at risk depends on several factors.

The actual security of the chemical handling and processes are themselves a source of potential danger - not just by being vulnerable to outside forces that can sabotage them, but by the very condition of the substances' storage, handling, and usage conditions. This "environmental" component is integral to any facility with chemicals, and although there are a host of environmental laws and guidelines designed to establish "safe" handling and storage of chemicals, a facility can still be "at risk" even if it handles things responsibly.

Another factor to consider with respect to enhancing the security of America's water infrastructure is how to protect the critical assets of a public water utility. A successful security program must take information security into account. All water utilities need to have policies, standards and procedures for addressing information assurance. A security assessment of information systems has to address how vulnerable a system is if there is a power loss, system control loss or security breach by an internal or external cyber attack.

Water is a national security concern. The federal government recognizes that our country's drinking water is a major target of terrorist and criminal activity and has therefore offered the security planning grants through the EPA. The message is clear: let's make the drinking water systems as safe as possible as soon as possible.

The first step towards realizing that goal is to assess a system's vulnerabilities. This should be accomplished by experts in environmental risk and by physical and information security experts. The water utilities need independent unbiased eyes that will conduct performance-based audits in a controlled and systematic manner. With the help of expert outside assessments, water utilities can take the necessary steps to ensure the protection of their employees and their customers.