Åttonde Nordiska Dricksvattenkonferensen - Svenskt Vatten

Introduction
This section considers the general background and issues of SCADA security.
Background
Industrial information and control systems are widely used for control automation to enable services,
quality and efficiency of water supply to the society. These industrial information and control systems are
often denoted as SCADA systems (which is the abbreviation for Supervisory Control And Data
Acquisition). SCADA systems still often use legacy technologies but have gradually, during the last
decades, evolved and now use more modern computer-based systems (Cegrell 1994; Johansson 1996).
Previously, SCADA systems have been relatively isolated. That is, stand-alone systems without
connections to other systems or networks. However, with the advancements in microprocessor
technologies, data could be multiplexed and collected from field stations and transmitted to a central
location for supervisory control. Radio and leased phone lines were incorporated for communication
between a central control room and field stations, resulting in the adoption of unattended monitoring and
control capabilities for pump stations and water pipelines.
Cost tends to be the primary motivational factor in modernizations of water utility plants. As a result,
spending on IT systems and security tends to be relegated to the margins. As these plants began to
automate from analog systems to digital control, they embraced "plug-n-play" systems to quickly
interconnect remote and distributed sites over Internet Protocol (IP) because it was cheap and
interoperable. In so doing, secure architecture wasn't a primary design consideration. In fact, the design of
these SCADA systems did not really consider security at all (Johansson 1996; Johansson 2009; Krutz
2006; Shephard 2002; Stamp 2003).
The increasing use of computer-based components, and the integration with other IT systems has also
affected the organisations staffing requirements. In several places, there are today fewer individuals that
maintain the water supply to society than just a decade ago. One single operator can easily monitor and
remotely control the waterworks pumps, valves and the entire water supply from a central workstation in
a control room. And further development have now made it possible to move this workplace, it is not
necessarily bound to a specific central control room, since applications exist to manage SCADA systems
from mobile devices.
Moreover, the computerization enabled the digitalization of other critical data, such as information
about the location of pipelines and descriptions of systems and their configurations. This simplification of
communicating data increases its availability to users and systems. However, this critical information is
increasingly being sent across other networks, making it possible to reach data far beyond the local water
companies' premises (Johansson 2007; Johansson 2009).
Increased security concern
Since many critical infrastructure services, such as water supply, depend on these SCADA systems,
any vulnerability in them may result in undesirable consequences for citizens and society. In the light of
the security breach that occurred more than ten years ago at Maroochy Water Services in Queensland,
Australia, concern has thus been expressed regarding the security of SCADA systems (NIST 2008).
Despite this concern, recent practical assessments implied that, information security is still weak when
it comes to SCADA systems. One could approximate from these assessments that SCADA security is
lagging roughly ten years behind traditional (office) IT-security. However, those findings might be
anomalies and therefore not relevant to most of the water utilities in Sweden.
In order to attain better understanding of the situation regarding information security at the drinking
water sector in Sweden a more comprehensive survey of the SCADA environments and their security was
initiated. This paper briefly illustrates and discusses the structure and general findings of this national
survey. However, the paper will not go into any details of specific critical findings.
48 Session 2: Säker dricksvattenförsörjning