To learn more about this training CD-Rom and how to order it, please see our order page.

Simple Tabletop Exercise
Scenario 3
Cyber Security Breach
Unusual Water Quality

As discussed in the Response Protocol Toolbox, the threat warning, or the occurrence or discovery that indicates a potential contamination threat that triggers an evaluation of the threat, can come from several sources. In these scenarios, the threat warning originates from either unusual water quality, as indicated by the utility's SCADA system, or from a consumer complaint regarding water pressure.

This scenario is an intentional cyber-security attack on the water or wastewater utility's SCADA system. It occurs during the summer in Zenith City. A disgruntled utility worker, laid off due to recent budgetary cutbacks, decides to infiltrate the SCADA system from a dial-in connection from his home computer. He infects the SCADA system with a virus that hinders its operation. The system begins to issue alarms that inform the utility operators that various systems in the treatment process are malfunctioning, and that the water or wastewater leaving the plant is not meeting water quality standards. The utility must discuss the vulnerability of SCADA systems and how they can improve their control of such vulnerable cyber-systems. In addition, they must discuss whether their staff are adequately trained to manually operate and check all of the utility’s systems in the event of a SCADA failure.

The following are some useful links to cyber-security information:

21 Steps to Improve Cyber Security of SCADA Networks [PDF - 2,502 KB - 10 pp]
(Source: The President's Critical Infrastructure Protection Board, and the Department of Energy, Office of Energy Assurance)

The National Strategy to Secure Cyberspace [PDF - 980 KB - 76 pp]
(Source: Department of Homeland Security)

Water and Wastewater Security Product Guide (Source: Environmental Protection Agency, Water Security Division)