New tools for water utility cyber security in KYBER-VESI project


The two-year joint project led by VTT resulted in assessment tools and guidelines which will improve the cyber security of the water supply. These are now available for operators in the sector. The tools will help safeguard Finland's security of supply during disruption or emergency situations.

In the KYBER-VESI (cyberwater) project that has just ended, VTT developed two separate assessment tools for water utilities. These tools will enable the utilities to assess the status and development needs of their cyber security from the perspective of automation and procurement. The assessment tools are specifically intended for cyber security personnel, automation managers and specialists at the utilities.

The project also generated a number of guidelines relating to cyber security. General guidelines, such as "Management of Water Utility Cyber Security" are intended for water utility executives and managers. The more technical guidelines enable personnel responsible for water utility automation, IT and cyber security to safeguard remote access solutions, radio, mobile and ICT devices as well as IDS systems at the utilities.  A guideline was also produced for the utilities' cyber physical security. It can be used by all personnel responsible for general security and continuity of operations at water utilities. In addition, brief cyber security guidelines were produced. The guideline, which contains some 20 topics, can be quickly browsed by topic area.

"Water supply is one of the fundamental requirements for the functioning of our society. Without drinking water or waste water treatment, we could not survive even a day. The particular features of Finland, such as cold climate, peripheral location and dependence on maritime transport bring their own challenges to the security of supply. The role of cyber security in critical functions such as water supply is indeed vitally important," says Research Scientist Heimo Pentikäinen, who acted as Project Manager in the project.

The project helped launch the water supply ISAC (Information Sharing and Analysis Centre) group directed by the National Cyber Security Centre, which aims at enabling information security issues to be handled confidentially between the participants. Through the exchange of information, the aim is to increase the information security competence of organisations and enhance the overall picture of cyber security in the sector.

The KYBER-VESI project is part of the National Emergency Supply Agency's KYBER2020 programme. The project was funded by the National Emergency Supply Agency, the Finnish Water Utilities Development Fund and the water utilities that participated in the project.