Cybersecurity Fundamentals for Water and Wastewater Utilities

The cybersecurity threat landscape for critical infrastructure is evolving rapidly, and the water and wastewater sector has become an increasingly attractive target for malicious actors. As cyber threats grow in sophistication and frequency, it is essential for utilities to strengthen their cybersecurity posture across both enterprise Information Technology (IT) and Operational Technology (OT) environments.

The Cybersecurity Fundamentals for Water and Wastewater Utilities course is specifically designed for water utility professionals who may not have formal cybersecurity training but are responsible for supporting or managing cyber risk in their organizations. It provides practical, actionable knowledge that bridges the gap between IT and OT security, enabling participants to better protect their systems and operations.

Participants will learn:

• The basic principles of cybersecurity and how they apply to water sector operations.
• Key differences between IT and OT systems, including distinct risk profiles, priorities, and operational requirements.
• The most common threats are targeting IT and OT environments in water and wastewater utilities.
• Foundational security measures that can be implemented to reduce risk across both enterprise and operational networks.
• How to leverage available cybersecurity tools, best practices, and frameworks (such as CISA guidance, NIST standards, and sector-specific recommendations) to build a more resilient utility.
• Real-world case studies illustrate the impacts of cyber incidents on water sector operations and lessons learned from these events.

Whether you are an operator, manager, engineer, or executive, this course empowers you with the knowledge to contribute to a cybersecurity culture that protects your utility’s critical services and safeguards public health and safety.

By the end of the course, participants will be able to:

1. Review Water and Wastewater Control Systems and Processes
   Identify how industrial control systems (e.g., SCADA, PLCs, HMIs) function in water and wastewater environments and the unique risks they face.
2. Evaluate Emerging Cyber Threats and Defense Strategies
   Review the evolving threat landscape and assess appropriate defense mechanisms relevant to the water and wastewater sectors.
3. Identify and Counteract Social Engineering Attacks
   Recognize various forms of social engineering (phishing, vishing, smishing) and implement mitigation strategies.
4. Illustrate Threat Modeling in OT and IT Environments
   Apply structured threat modeling approaches to identify, assess, and mitigate risks across both operational and enterprise networks.
5. Apply Risk Management Frameworks to Critical Infrastructure
   Use frameworks such as NIST CSF, ISA/IEC 62443, CIS Critical Controls, and SANS Five Critical Controls to assess and manage cyber risk in IT and OT systems.
6. Assess Cyber Contracting and Legal Considerations
   Discuss the legal and regulatory aspects of cybersecurity, including best practices for procurement and third-party risk management.
7. Identify Incident Response Processes and Procedures for OT and IT
   Explain the phases of incident response—preparation, detection, containment, eradication, recovery, and post-incident analysis—tailored to both IT systems and industrial control systems.