In response to the need for sound security information, the new Water Information Sharing and Analysis Center (WaterISAC) recently went online to provide America's drinking water and wastewater utilities a secure web-based environment for early warning of potential physical, contamination and cyber threats.
Developed by the Association of Metropolitan Water Agencies (AMWA) with grants from the U.S. Environmental Protection Agency, the WaterISAC gives water system operators an information edge in the fight against terrorism.
Long before September 11, large public water utilities had protective systems in place to deter sabotage of their facilities and water sources. Since the attacks, these agencies have conducted vulnerability assessments of their systems, performing upgrades to enhance security and improving emergency response planning.
As part of this security focus, water systems are encouraged to develop contacts and relationships with their local law enforcement and local FBI office and to participate in Local Emergency Planning Committees (LEPC). The role of the WaterISAC is to supplement and enhance these efforts, providing up-to-date intelligence and analysis that can be used to continuously improve and renew emergency plans.
Launched in December, the WaterISAC's array of information and tools will assist utilities in identifying and assessing threats, in taking measures to mitigate those threats and in analyzing incident reports. It will also serve as a link between the water community and federal government agencies. Ultimately, the project will encompass collaborative tools for utilities, law enforcement officials and emergency responders to share information in a secure environment.
Information Plus Analysis
The WaterISAC takes water system security to the next level. More than a security clearinghouse, it goes beyond gathering and distributing information on threats by taking the additional steps of analyzing the credibility of the information and identifying trends. This sensitive and valuable information will be distributed to subscribing water systems through encrypted email and a secure portal, making the WaterISAC the one place where all sensitive security-related information is available to U.S. drinking water and wastewater utilities.
For the first time, water systems will have a forum for the secure exchange of sensitive information and intelligence. When fully realized, the WaterISAC will provide a secure meeting ground for the drinking water and wastewater community — a convenient, efficient and low-cost source of reliable security information. Beyond these immediate objectives, the WaterISAC will be designed to offer:
• repository for security-related plans and documents,
• focal point for online training and education on security topics,
• place where utility managers can share information, counsel and advice in a secure setting,
• contact point for links and resources beyond the world of water utilities and
• security library tailored to the needs of utilities.
Secure Site
Analysts for the WaterISAC have top secret clearance and will operate in a secure environment. The computer servers for the WaterISAC portal reside in the cleared facility and are protected by security barriers and monitored by Information Technology (IT) security experts. Communications from the WaterISAC to subscribing utilities will be conducted through encrypted email.
A number of different sources will be used to gather information for the WaterISAC, including government (local, state, federal and law enforcement), classified sources (intelligence community), publicly available information (Internet, newspapers), the water community (utilities, water associations and research foundations), and private entities (think tanks, etc.). WaterISAC analysts will gather information from these sources and then assess, sanitize and disseminate it, enabling water utilities to make better-informed security decisions.
Within the WaterISAC's analytical organization, a lead analyst will be in charge of a specific threat. Depending on the information, contamination, physical, and/or cyber analysts would be brought in to review the raw data. Subject-matter experts will be on call and brought in on an as-needed basis. In conducting analysis for the WaterISAC, analysts will look for patterns and trends in seemingly unrelated events and will seek associations that may link several events together.
Web Interface
The web interface for the WaterISAC is designed to be user friendly, with a homepage that provides security information in an easy-to-find format. Other elements of the WaterISAC web site will include:
• Resource library – Database of contaminants
• Access incident reporting analysis
• Repository for vulnerability assessment tools and research
• Collaboration via chat rooms and forums in a secure environment
• Incident reporting with identification of trends across industry or region
• Utility profiles
• Key web site links
• Online help
• WaterISAC Governance
The Association of Metropolitan Water Agencies (AMWA) is developing the WaterISAC with funding assistance from the U.S. Environmental Protection Agency. AMWA has contracted with a team of contractors headed by Westin Engineering, Inc. and including HDR, EWA Information and Infrastructure Technologies and Candle Corporation. The WaterISAC development relies on an advisory panel of water utility mangers for recommendations and advice. In addition, AMWA has established a non-profit organization (WaterISAC Corporation) which will be governed by a board of utility managers appointed by the following organizations:
• American Water Works Association
• Association of Metropolitan Sewerage Agencies
• Association of Metropolitan Water Agencies
• AWWA Research Foundation
• National Association of Water Companies
• National Rural Water Association
• Water Environment Federation
• Water Environment Research Foundation
WaterISAC Subscriptions
The WaterISAC is open to all U.S. drinking water and wastewater systems. The information on the WaterISAC is specifically geared to drinking water and wastewater utility executives, mangers, operators and security officers. Because of the sensitive nature of the information, subscribers will be asked to agree to set standards of security and confidentiality of information.
Additional information on the WaterISAC can be found online at www.waterisac.org.
