Priority for 2024: CYBERSECURITY

Select recommendations from the Halifax Water cybersecurity audit, released in
2023. (All recommendations have been addressed or are currently being addressed.)
Halifax Water should:
1. Develop plans, with timelines, to complete the remaining SCADA master plan cybersecurity
recommendations.
2. Provide regular SCADA cybersecurity updates to the Halifax Water Board of Commissioners.
3. Review and update its SCADA cybersecurity policies, ensuring they cover all key cybersecurity
areas, and formally communicate policies to employees.
4. Document and implement its SCADA cybersecurity procedures. This should include developing
plans and timelines for when they will be complete.
5. Implement a process to review, approve, and monitor software installed on SCADA laptops.
6. Provide SCADA system users with regular training or information to increase awareness of SCADA
security risks, policies, and procedures.
7. Implement a process to maintain regular backups of the SCADA system.
8. Finalize and implement cybersecurity training awareness campaigns.
9. Reduce the number of users with domain administrator privileges to a small number who require
this level of access for their jobs.
Dr. Philip N. Owens
There is good news for our sector, however, in that a
suite of free water utility-specific cybersecurity resources is now available from Public Safety Canada (PS)
and the Canadian Water and Wastewater Association
(CWWA).
The journey to the release of these tools, explains
CWWA Executive Director Robert Haller, began more
than 10 years ago when CWWA participated in a national roundtable examining all types of critical infrastructure security. “We then did a national survey with
PS and scientists at Dalhousie University to take a measure of security levels at water and wastewater plants,”
he recalls. “This helped us identify where we’re at and
what training is needed.” CWWA, PS, and consulting
firm Deloitte then conducted a second survey and
released the national guidance documents and training
programs in collaboration with the Canadian Centre
for Cybersecurity (CCCS). Water plant managers can
work through an audit (the Canadian Cybersecurity
Tool 2.0 was released in October 2022) and use other
resources to analyze and improve their cybersecurity,
while they and staff can undergo online training.
Since that point, CWWA has been actively presenting and promoting these resources in its webinars and
WAT E R C A N A D A . N E T
WATER C AN ADA • M ARCH/APRIL 2024
21

Paperturn flipbook