Protecting Infrastructure: It's Not Just Dams And Pipes
By Steve Snyder
Because technology is a critical part of delivering water, Denver Water tested its readiness against a cyberattack.
It started with a trickle, but ended in a flood. It was a water utility’s worst nightmare.
But the scenario had nothing to do with water. And it wasn’t a real-world situation. It all played out in a Denver Water conference room, as part of a functional exercise focusing on cybersecurity.
The scenario? At the beginning, one employee can’t access the internet and calls the IT Help Desk. Then a whole group of employees can’t get into their computers. Critical systems begin failing.
Denver Water is under a cyberattack, and water quality and delivery experts must keep the water flowing.
Denver Water’s Information Technology team discusses how to respond to a scenarios created in a recent cybersecurity exercise. (Photo credit: Denver Water)
Even though this event was simulated, more utilities are dealing with the reality of technological attacks.
Last October, a North Carolina water utility fell victim to a ransomware attack, with hackers demanding payment to unlock affected systems. The hack had even more impact because the region was still recovering from Hurricane Florence.
Denver Water doesn’t want to be next, so recently workers from across the organization participated in an exercise made possible by a federal grant to help urban areas respond to risks. In this case, it was to test readiness for a cybersecurity attack.
“Cyberattacks impact the entire enterprise, not just one component,” said Jason Taussig, director of Emergency Management, Safety and Security at Denver Water. “Physical attacks are disruptive but are easier to detect and usually attack only one component. With a cyberattack, you have multiple operations compromised at once, raising the stakes even further.”
Denver Water has a dedicated emergency management team focused on preparing the organization for potential issues and challenges.
Along with Denver Water’s dam safety team, emergency managers frequently conduct large-scale exercises at dams in conjunction with potentially impacted stakeholders and partners. Watch “When reservoirs go wild” to see hundreds of experts from local, state and federal agencies band together in mock scenarios at Dillon Reservoir in 2014 and Gross Reservoir in 2015.
“One of the most helpful parts of this exercise was the regional component,” said Marcelo Ferreira, an emergency management specialist at Denver Water. “Working with stakeholders and community partners before a disaster helps us better understand how to share information and resources in the event of a real-world emergency.”
Denver Water’s Emergency Management team will take the information learned during the exercise and share it in the coming months within the organization.
Taussig says it was a valuable exercise that will pay dividends down the road should a real incident occur.
“Too often we are so busy working in our business that we are unable to work on our business,” he said.
“Exercises like this provide a great learning opportunity by forcing us outside of the day-to-day operations to consider what may occur. We evaluated our plans and practiced them in a simulated environment with a scenario that forces us to think through some tough choices. We made substantial gains in our preparedness efforts because of this exercise.”