Improving water supply cyber security in Finland 

A two-year project has culminated in assessment tools and guidelines to improve the cyber security of water supplies, helping to safeguard Finland’s supply security during disruption or emergency situations.

_{Image Mungkorn Lasonthi / 123rf}

"Water supply is one of the fundamental requirements for the functioning of our society. Without drinking water or wastewater treatment, we could not survive even a day. The particular features of Finland, such as cold climate, peripheral location and dependence on maritime transport bring their own challenges to the security of supply. The role of cyber security in critical functions such as water supply is indeed vitally important," says Research Scientist Heimo Pentikäinen, who acted as Project Manager.

Led by VTT Technical Research Centre in Finland, two separate assessment tools for water utilities were designed to enable assessment of the status and development needs of cyber security from the perspective of automation and procurement. The tools are specifically intended for cyber security personnel, automation managers and specialists at the utilities.

The project also generated a number of guidelines relating to cyber security. General guidelines, such as Management of water utility cyber security, are aimed at water utility executives and managers. The more technical guidelines enable personnel responsible for water utility automation, IT and cyber security to safeguard remote access solutions, radio, mobile and ICT devices, as well as IDS systems at the utilities. 

A guideline was also produced for the utilities' cyber physical security, which can be used by all personnel responsible for general security and continuity of operations at water utilities.

In addition, brief cyber security guidelines were produced.

The project helped launch the water supply ISAC (Information Sharing and Analysis Centre) group directed by the National Cyber Security Centre, which aims to enable the confidential handling of information security issues between stakeholders. Through the exchange of information, the aim is to increase the information security competence of organisations and enhance the overall picture of cyber security in the sector.

The Kyber-Vesi project is part of the National Emergency Supply Agency's Kyber 2020 programme and was funded by the National Emergency Supply Agency, the Finnish Water Utilities Development Fund and the water utilities that took part in the project.