The issue of cybersecurity and the risk of cyber attacks is continuing to grow for essential services, including water utilities. VicWater is showing how being Better Together can help the sector protect itself.
Tara Daniel has been working for VicWater for two years while being in the industry for more than 15 years, both in Australia and the UK. Her insights into how cyber security impacts the water industry provide a view into the future.
“Joining the water industry was an accident,” Daniel said. “I was looking for a job when I graduated and was in the UK at the time. Most of the bigger manufacturing companies that could have utilised my knowledge in chemical engineering had closed their graduate programs. However, the energy and water industries were still open. I managed to land a gig with Severn Trent Water in their water quality team, and I’ve never looked back.”
In her time in the water industry, Daniel has spent time in various areas within the water sector. That includes operations, strategic planning, and digitalisation.
Data and digitisation
One of the biggest benefits of digitisation is the increased quantity and quality of data available for water utilities. Daniel believes that with all the different data sets, water utilities can pull them together to find new information.
“In my previous role (at Goulburn Valley Water), we did a lot of work examining water pattern usage throughout the day,” she said. “We could actually work out which houses were experiencing financial hardship because their water consumption patterns differed from others. This came from overlaying different data sets that traditionally would have been separate. There is a lot of opportunity to come with so much data.”
Getting in front of issues and supporting customers is essential for water utilities. At the same time, having all that information presents its own challenges.
“The big question that needs answering is how to deal with all that data,” Daniel said. “Water utilities need to work out what data to keep, how to store it securely, who has access to the data, and whether it is the right data.”
Internet of Things
The uptake of Internet of Things (IoT) devices across water networks has seen water utilities access information that helps them predict what can happen in their system, including water treatment plants and sewerage systems.
“It also allows water utilities to be better prepared for what might happen to their networks during different situations,” Daniel said. “There’s also the possibility of using artificial intelligence (AI) to pick up new things in the networks. There are real benefits in finding efficiencies across the operational landscape.”
At the same time, one of the biggest challenges is dealing with different operating systems across the entire information technology system. Each product range can have its own operating system or cloud-based services. Working out how to use the data efficiently and practically can also take a lot of work.
“One challenge we are facing is the upscaling and upskilling around new technology,” she said. “With the rate of technology changes, preparing the staff to use that new technology can be tough for water utilities. That’s very true when considering the thousands of people employed by these institutions.”
Cybersecurity
Daniel has seen how views on cybersecurity have changed throughout her career. When she started, no one was talking about cybersecurity, but it became an emerging issue on the periphery of risk management.
“It’s now something water corporations view as a key risk,” she said. “I think it’s really embedded in a lot of what is being done across the sector on a day-to-day basis. When we look at cybersecurity from a water sector perspective, these companies supply essential services. That creates a range of issues around the continuity of service for customers.”
Daniel says there are two specific aspects to dealing with cybersecurity for water utilities –physical security and access.
“There’s a lot of work being done on what data has to be held by law versus what would be nice to hold onto,” she said. “There is a tension between what has to be kept under different laws and regulations and people’s concerns at having their personal data held. I think that some of these regulations haven’t kept up with the reality of data protection. .”
The vast amount of data held by essential services like water utilities is front of mind for these businesses. Seeing what has happened across Australia and worldwide has made them cognisant of the amount of personal data that could be used negatively.
“That’s why there is a lot of data auditing in terms of what is being kept,” said Daniel. “There’s also a lot of work around data governance. It’s not just customer data but also employee data. That data contains information about people’s sexuality, race, religion, gender, and other diversity issues. This is a prime example of reassessing the data they have on hand and determining whether it needs to be kept. If it needs to be kept, where is it stored so it is secure?”
Cyber Governance Steering Committee
VicWater continues to play a role in coordinating cyber-related activities through the Cybersecurity Governance Steering Committee and working with relevant Victorian Government agencies to strengthen the sector’s capability.
“The Cybersecurity Governance Steering Committee (CGSC) was formed in 2020,” said Daniel. “Initially, the CGSC came together to work with the Office of the Victorian Information Commissioner (OVIC) to create an addendum to the Victorian Protective Data Security Standards (VPDSS) to cover operational technology (OT).” The committee continued to meet after this, as they felt it beneficial to come together for collaboration, knowledge sharing and being Better Together.
“The CSGC provides a Victorian water sector perspective to the overall view on cybersecurity across Victoria,” Daniel said. “There are several cyber security communities of practice, including one from the Water Services Association of Australia (WSAA), which looks broadly at the Australian water sector. The Victorian Department of Government Services (DGS) also shares in a community of practice specific to the Victorian public sector incorporating many different entities.”
The members of the CSGC tend to be cybersecurity subject matter experts and work at water utilities across the state. Every water utility and the Department of Environment, Energy, and Climate Action (DEECA) are represented, and their unique perspectives help the group make decisions and work together.
“We are working closely with DEECA to develop a sector-wide exercise to test emergency arrangements,” Daniel said. “Over the last couple of years, we’ve also worked closely with DGS to develop a strategic plan for the water sector focused on uplifting capability.”
The future
Daniel believes that the future of cybersecurity risk is a constant sea of change. Given the changes in technology over the past 40 years, there is no doubt that the risk will increase.
“I think part of managing this risk will come down to having the right people with the right training and skills in the right places,” she said. “Everything is changing, and the industry needs upskilling. That’s not limited to IT staff but everyone across the water industry. Everyone can hold a keyboard and play a role.”
For more information, visit: vicwater.org.au
Related Articles:
- Why does clean data matter in construction?
- Rising star recognised as future CIO
- WaterNSW issues open tender for ICT services