Securing wastewater facilities from accidental and intentional harm: A cost-benefit analysis

Abstract

It has been widely reported that industrial control systems underpinning critical infrastructures ranging from power plants to oil refineries are vulnerable to cyber attacks. A slew of countermeasures have been proposed to secure these systems, but their adoption has been disappointingly slow according to many experts. Operators have been reluctant to spend large sums of money to protect against threats that have only rarely materialized as attacks. But many security countermeasures are dual-use, in that they help protect against service failures caused by hackers and by accidents. In many critical infrastructure sectors, accidents caused by equipment failures and nature occur regularly, and investments for detecting and possibly preventing accidents and attacks could be more easily justified than investments for detecting and preventing attacks alone. This paper presents a cost-benefit analysis for adopting security countermeasures that reduce the incidence of sewer overflows in wastewater facilities. The paper estimates the expected annual losses at wastewater facilities due to large overflows exceeding 10,000 gallons using publicly-available data on overflows, cleanup costs, property damage and regulatory fines. Also, it estimates the costs of adopting security countermeasures in wastewater facilities in eight large U.S. cities. The results of the analysis indicate that, in many cases, even a modest 20% reduction in large overflows can render the adoption of countermeasures cost-effective.

Introduction

Supervisory control and data acquisition (SCADA) systems and industrial control systems (ICSs) are widely used to control systems such as water supply systems, wastewater collection and treatment facilities, refineries, oil and gas pipelines, factories, ships and subways. These systems have evolved from direct human control to computer-based control over the last several decades. Once computer-based control became common practice, a migration from proprietary to standards-based systems, protocols and interfaces occurred. Today, many systems have adopted standard wireline and RF physical interfaces, and the TCP/IP protocol is commonly used to move command and status messages within these systems. To ease management, the trend has been to connect these control networks to company intranets, which are normally connected to the Internet.

Unfortunately, SCADA systems and ICSs were not designed to defend against even the simplest network attacks. Operational commands, controller software updates, and operational status messages are not authenticated [32]. As a result, these systems are vulnerable to command injection [9] and middle-person attacks [18]. A programmable logic controller (PLC) attack was at the heart of the Stuxnet virus that targeted Iranian uranium hexafluoride centrifuges [15]. Effectively, Stuxnet used a middle-person attack to change the PLC logic to report normal centrifuge operations to plant operators while issuing control commands that damaged the centrifuges.

Research efforts focused on control systems security typically take for granted that an attack will occur and instead focus on adopting security countermeasures to thwart attacks. However, attacks have been so rare in practice that asset owners and operators are reluctant to invest in adequate defenses. This paper studies one particular critical infrastructure sector – wastewater collection and treatment systems – and investigates whether the expense of security countermeasures can be justified, provided that they can also be used to prevent accidents as well as attacks. The wastewater sector is selected precisely because the intended effect of a cyber attack is the same as a relatively common failure mode – a sewer overflow. Furthermore, systems for detecting malicious overflows in wastewater systems can also detect accidental ones.

The next section, Section 2, outlines the threat model for wastewater facilities and explains how security countermeasures can be deployed in a representative system to detect and prevent sewer overflows. Section 3 presents a framework for calculating the expected costs of large sewer overflows. Detailed public data from the California Water Board is used to estimate the incidence of large sewer overflows. Reports of legal settlements are collated to estimate the cost of property damage, and EPA data on Clean Water Act violations are examined to estimate the cost of regulatory fines as well as the probability of drawing the ire of regulators. Also, an estimate for the cost of comprehensive security countermeasures is provided. Section 4 presents a cost-benefit analysis based on the findings discussed in Section 3. The net expected utility is assessed by comparing the costs with the benefits of experiencing fewer overflows. Because wastewater facilities vary greatly in complexity, a detailed analysis is provided for facilities in eight U.S. cities, with the results demonstrating that some cities are likely to view the costs as acceptable whereas other cities will not. Section 5 reviews related work in the field and Section 6 discusses key limitations of the analysis and outlines opportunities for future research.