Small System Security
Threats and Vulnerabilities
- Risk Assessment and Mitigation
- Mobile Emergency Systems
EPA is the lead agency for protecting our Nation's water infrastructure. EPA sends out information to water utilities about steps they can take to protect their water sources and infrastructure. Every community with a population greater than 3,300 will conduct a water system vulnerability assessment (VA) and develop an Emergency Response Plan. VAs are intended to:
- identify potential threats,
- review the critical assets of the system,
- evaluate the likelihood and consequences of an attack, and
- identify system upgrades to increase security.
Threats and Risks to the Water Supply – Small public water systems are more likely to be severely threatened if their source water is a significant distance away. It is important for small system managers to understand their risks. System managers must provide appropriate security, use suitable detection systems, and develop strategies to deal with potential contamination events.
Chemical and Radiological Contaminants – Chemical contaminants include inorganic, organic, radiological, and other warfare compounds. They may have a variety of impacts on water quality and the consumer. The impacts can range from a harmless change in color to fatalities in the exposed population.
Biological Contaminants – An average of 10 to 15 outbreaks of disease from tap water happen annually in the United States. The disease is caused by bacteria, viruses, and protozoa.
Remote Monitoring and Control – Drinking water regulations require water quality monitoring to ensure water quality. Remote monitoring and control is a technology used to control all aspects of a device from a centralized location. It may also be called remote telemetry or supervisory control and data acquisition (SCADA). These systems are vulnerable to attacks that may disrupt the operations of the utility and damage equipment. The primary security vulnerabilities for SCADA systems are the communication links, the computer software, and power sources. The Association of State Drinking Water Administrators and National Rural Water Association suggests:
- Password protect all computer access.
- Install a firewall protection program.
- Subscribe to a virus protection program
- Perform regular computer backups
- Have backup power systems.
Risk Assessment and Mitigation
Small systems are encouraged to implement actions that prevent identified VA threats and vulnerabilities. Some key steps include:
- Routine monitoring of treatment and supply infrastructure
- Increase in security procedures, such as identification for employees and visitors, security discussion at staff meetings, securing the facility perimeter with a fence, locking all points of entry, and having adequate security lighting
- Routine inspection of facilities
- Suspending public access to facilities
- Routine testing of water quality
- Properly install vents and caps to prevent the introduction of a contaminant
- Secure surface water sources
- Control the use of hydrants and valves
Remote Monitoring and Control - Water quality sensor equipment, such as SCADA, may be used to monitor water or wastewater treatment processes to:
- improve reporting,
- educe operation and maintenance costs, and
- identify discrepancies that may indicate threats to the system.
Some sensors may indicate problems in the system but do not identify sources of contamination directly. Others measure potential contamination directly. In addition, sensors can provide more accurate control of critical components in water and wastewater systems. They may provide a means of early warning so that the potential effects of certain types of attacks can be lessened.
Physical monitors tend to be relatively inexpensive, quite durable, and readily available. They are used to measure physical characteristics of the water, such as:
- water level,
- temperature, and
- oxidation-reduction potential.
Chemical monitors are used to detect and measure inorganic or organic chemicals that may be present in the water.
Biological monitors (biomonitors) include biosensors and biosentinels. Biosensors detect the presence of biological species of concern, such as some forms of algae or pathogens. Biosentinels use biological organisms as sentinels to determine the likely presence of toxicity in a water sample. The use of biomonitors is ideally suitable for security issues. EPA has been evaluating a variety of small SCADA systems that would allow a single qualified and certified operator to monitor and control the operation of several small treatment systems from a central location. They have some degree of automation designed specifically for small systems. The use of a SCADA system results in:
- enhanced security and control,
- best use of time for onsite inspections and maintenance,
- improved water quality,
- regulatory compliance, and
- reduced overall maintenance costs.
EPA plans to work on mobile emergency system designs to
- treat either a broad spectrum of water quality contaminants or
- specifically treat specific classes of contaminants.
Learning from natural disasters and contamination events, the need for a robust, easy-to-operate, and effective multiple barrier treatment process is essential. The multiple barrier approach places pollution prevention at the water source, treatment, and tap. The barriers are:
- Risk Prevention – selecting and protecting the best source of water or protecting a current source of water
- Risk Management – using effective treatment technologies, properly designed and constructed facilities, and certified operators
- Monitoring and Compliance – detecting and fixing problems in the source water or in the distribution system
- Individual Action – providing customers with information on water quality and health effects so they are better informed about their water system
What is EPA Doing?
- Mobile treatment systems are being assessed for their ease of use and useful life.
- EPA is testing and evaluating mobile filtration and disinfection technologies to verify their ability to protect homes, businesses, and distribution systems from microbial contaminants in drinking water.
- EPA’s research studies are verifying the capability of mobile emergency systems to reduce bacteria and viruses in drinking water.
- Treated water is being monitored for the formation of product-specific by-products and disinfectant residuals.