Defending Our Water - Defending Our Lives

The panel opens with the scale of the US water sector, which spans roughly 150,000 systems from large metropolitan utilities to small local operators. The speakers say cyber risk has climbed the list of utility concerns, while regulation remains uneven, with state rules varying and a proposed federal water body still pending. They frame the core problem as a gap between IT teams that manage the digital layer and engineers who understand which physical processes can fail.

The middle of the session introduces cyber-informed engineering, a method that asks engineers to identify the worst consequences an adversary could cause and to design process safeguards that limit them, rather than relying only on perimeter defense. The speakers stress that digitally enabled failure modes can damage equipment even when a system appears to run faster or smoother. They describe assessments where utilities now discuss worst-day scenarios more openly than before. A worked example of a booster pump station with cloud-based control shows how a low-cost time-delay relay and a pressure tank could keep an attacker from damaging pumps, turning a severe threat into a recoverable outage.

The closing segment covers adoption. Cost concerns are answered by prioritizing high-consequence assets and piloting narrowly, and state grant scoring that rewards engineering-based cyber planning is offered as an example of incentives. Exercises that run operators through a day without SCADA are presented as a practical starting point. The takeaways are to involve engineers and operators early, build on existing safety and reliability practices, and encourage community members to engage with their local utility and council.