INSIGHT
Managing the “New Normal”
| |
Craig Yokopenic
Executive Vice President |
|
The “new normal.” It’s a term used frequently within our industry today – and for good reason. Utility leaders are managing in an environment filled with challenges unprecedented both in number and complexity.
The “new normal” for utility leaders includes working amidst budget shortfalls at the state and local levels as well as other economic pressures; dealing with the rising cost of energy and chemicals; improving deteriorating infrastructure; managing environmental, political, and technological challenges; and adhering to ever-tightening government regulation, to name a few.
In this business climate, utilities – now more than ever – have an obligation to control spending, exercise responsible decision-making, and increase efficiency.
But that is not always enough. Some utilities are discovering that while they’re running a tight ship, other areas of municipal government are facing shortfalls, and money once designated for these utilities may be headed somewhere else to cover the shortfall. Bottom line, a growing number of utilities have to fight to keep what is theirs.
What it comes down to is utilities must have the relevant data on hand to make their case. If you are efficient, you need to have the data to prove it, and stand your ground. If you have urgent needs, you must have the data that shows the significance of the situation to ensure funds are appropriated to meet your needs.
Managing the New Normal
Juggling a multitude of challenges, utilities need to know where they stand and determine just how efficient they really are. An assessment of your organization, practices, and technologies establishes a baseline, showing your utility where you are and where you need to go.
Why is this important? An assessment identifies a utility’s relative position to maximum efficiency and effectiveness. Identifying the organization’s strengths and weaknesses, the assessment helps utilities better understand their overall needs. The assessment process supports more effective utility management, as it has a direct correlation to each of the 10 attributes associated with stronger, more efficient and effective utility management. An assessment can help utilities:
- Improve product quality and customer
satisfaction
- Cultivate employee and leadership development
- Strengthen operational optimization, infrastructure stability, and operational resiliency
- Maintain financial viability and water resource adequacy
- Support community sustainability
- Generate greater stakeholder understanding and support
Information obtained in an assessment has value regardless of where you fall on the efficiency spectrum. If your utility has practices and processes in place that make you efficient, an assessment confirms this. For those utilities with opportunities to improve, an assessment can be used to develop a strategic plan that prioritizes strategies to improve work practices, technology, and overall organization; increase efficiency and effectiveness; and communicate more effectively with stakeholders.
A New Day, A New Approach
Amidst budget shortfalls, it may not be enough to run a tight ship. Utilities must understand their relative position in order to defend where they stand and address their issues. An assessment is key to mitigating the demands of the new normal. It helps us get where we need to go by providing the data we need for more effective utility management.
That is what this issue of Communicator is all about – new ways to look at how we can become more efficient and effective. From aligning our IT with our business strategy (Foresight) and re-evaluating how we actually value water as a resource (Q&A) to taking a more holistic systems-wide approach toward operations (Client Story) and striving to keep our systems more secure (Efluent), this issue explores how we can manage our utilities more effectively.
BACK TO TOP
FORESIGHT
Aligning IT With Your Utility Business
Strategy: Why It’s Important

Dave DiSera
Vice President
|
|
Economic pressures, evolving policies, process improvements, and business initiatives continue to drive utilities to be more productive, more efficient, and measurably better in service and results.
From an Information Technology (IT) standpoint, the demand on utilities to achieve higher operational efficiencies means IT must be more agile. Utilities must continue to control IT costs; integrate their systems, data, and processes; and determine where to invest in IT to support core business objectives. To do this effectively, utilities must align their IT strategy with their business strategy.
Aligning your IT and business strategy correlates directly to more effective utility management. It helps strengthen operational optimization and operational resiliency, support financial viability, and improve customer service and product quality. This alignment helps you:
- Identify how your IT department can provide greater value to your business
- Determine how to gain greater value out of your technology
- Understand the new IT capabilities you need to enable emerging service delivery opportunities
- Set a strategic direction that links your business challenges with leading-edge thinking on technology issues
- Enable the development of the right enterprise integration strategy to improve performance
IT is a significant organizational resource for executing business strategy. This makes alignment vital. No IT solution on its own will deliver improved operational performance. The performance comes from leveraging one’s systems to achieve business goals and objectives.
Benefits of Alignment
The benefits associated with aligning your IT and business strategy are significant and enterprise-wide in scope. Utilities that have aligned their strategies have seen:
- More timely and informed decision making
- Higher operational efficiency enterprise-wide
- Better collaboration throughout business units
- Greater return on investment on technology
- Improved compliance reporting practices

Aligning Your IT & Business Strategy
For a better understanding of how your utility can achieve successful alignment between its IT and business strategy, it is helpful to identify factors that promote alignment. A number of key success factors have proven useful in supporting alignment:
- IT as a Business Enabler – Utilities must view IT as a resource and business enabler to ensure new and emerging IT opportunities that impact business strategy formation are recognized.
- Organization-wide Involvement – Collaboration between business and IT functions and organization-wide participation are required during strategy development. This includes active involvement of the CIO or IT Manager.
- Organizational Culture & Communication –
A supportive organizational culture helps build a solid relationship between business and IT functions. It starts at the executive level with the view that IT is a business resource used to achieve business needs. Consistent, effective communication builds understanding and instills productive thought about IT and business strategy alignment.
- Governance Process and Structure – A governing process must be in place to support strategic decision-making, as well as an organizational structure that advocates accountability and ownership of strategy development. This instills a strong sense of individual responsibility and accountability during the development and alignment of strategies.
- Long-term Perspective – IT and business strategy should hold a long-term view on critical issues for successful alignment. Without a long-term focus, alignment is limited at best.
- Consensus Building – Executives must share a common vision and reach consensus on organization-wide strategic issues between business
and IT.
- Management Capability Level – IT and business managers must have well-developed management capabilities. Business managers must understand technology, and IT managers must understand the business functions of the utility to ensure success.
BACK TO TOP
Q & A INTERVIEW
The Value of Water
The “extraordinary” response to an article he wrote on bottled water led Charles Fishman to write “The Big Thirst,” a new book that explores our relationship with water.
“You can’t write about bottled water without understanding the larger world of water,” Fishman says, noting the absurdity behind the economics of bottled water, where a single half liter bottle costs more than an entire day’s water service delivered to our homes.
Water is central to our lives, Fishman says, yet people know little about it and take it for granted. He also says “the era of easy water is over,” and cites examples of how businesses and utilities are working to solve their water challenges, some more successfully than others.
EMA recently spoke with Mr. Fishman about how we value water.
You say we know very little about water and cannot appreciate what we don’t understand. What do we need to know about water?
Just about everything. People who aren’t in the water business have no idea how magical water is as an actual substance. It’s a cliché to say it is essential. So many things we do every day start with water, and we have no idea that they do.
Ordinary people also have no idea how incredible the system is that brings them the water. The book builds on those two foundations – the stuff is incredible, the system to get it to you is incredible – and it’s all at risk in a bunch of different ways.
The book also tries to re-establish the connection between ordinary people and their daily water usage and to plant seeds with people so when the conversation about their own water systems comes up in terms of modernization, operations, and rates, they have a different foundation.
This connects directly to what people in the water community don’t know about water and need to know. It’s very presumptuous of me to talk about this, but with all respect for the work people in the water world do, they actually have done themselves and us a great disservice. The disservice is they never talk about what they do. They are proud of the brilliant invisibility of the system. That’s nice, but people don’t value what they don’t understand. They don’t value something if they don’t see the work, effort, and capital investment that’s required.
It is a point of pride in the industry that they are kind of the silent servants. Your water service never fails, and the people who run it don’t brag about it or even talk about it except when pressed or when resources become scarce. The result is people go beyond taking it for granted. People assume the water system will work, and whatever money you’re getting is enough. This ignorance leads to an undermining of support for the system we all depend on.
Ordinary people need a real vivid sense of the water system. People in the world of water need a fresh way of talking about water so they aren’t stuck in the old patterns of just making do.
Bottled water, cable, cell phones, and designer coffee all have found their way into our culture in large part due to marketing. How does marketing factor into establishing a value for the resource of water?
I don’t like the word “marketing.” I like the words “ignorance” and “understanding.” Most people are water illiterate, so it’s marketing at a very basic level in that if you’re going to charge people for something, they want to know what they’re being charged for. The only way to do that is to talk to them about it.
The best example is Coca-Cola. Half the cost of producing a two liter bottle of
Coca-Cola is marketing. There’s nobody in the world who doesn’t know what Coca-Cola is. All deference to Coke, it’s not that complicated a product. Yet they take whatever it costs to make the product and double that just for marketing. They know you need to continue talking to people to keep them connected.
The water system is at least as interesting, complicated, and important as Coca-Cola. I’m not criticizing Coca-Cola at all. They do great at their business, which includes bottled water. Water people will say, “Well, we did a bill insert back in June of 2010 and explained the cell phone and cable bill comparison to water bills, and it didn’t have any impact.” Right. You did it once on a bill insert, and it didn’t have any impact.
You have to be creative and never stop. The problem is, that costs money. So how can you fold those things together in a way that engages people without generating more criticism that you’re spending money explaining their water system to them?
The water system is interesting and important. People happily pay for what’s important to them and what they understand. There’s no better example than the one in the middle of the world of water, which is bottled water.

BACK TO TOP
CUSTOMER STORY
The Next Wave:
Operations-Focused Utility Management
Making the Shift from Growth-Oriented to
Operations-Oriented Utility Management
by Larry Jentgen, Principal Engineer, EMA
As an operations engineer/manager and consultant to the water and wastewater utility industry for more than 30 years, I have observed a significant trend in the business of managing utilities.
There has been a shift from growth-oriented to operations-oriented utility management. The utility infrastructure has been planned, engineered, and built to accommodate substantial growth over the last 50 years. Management’s emphasis is shifting to more effective operation of the system infrastructure.
Current Trends and Drivers
Trends lend insight into why utilities are shifting from a growth focus to operations-oriented utility management:
Social & Economic
Residential construction trends bring new challenges to operating a water/wastewater utility. New residential construction has been cyclical, but a dramatic fall has occurred during the last five years. (Figure 1) This means a significant source of revenue, impact/connection fees, and associated business need to expand infrastructure to meet new growth has diminished.
 |
Figure 1. Residential Construction Trends (U.S. Census Bureau) |
The steepest growth and decline is seen in the South and West. At the Las Vegas Valley Water District (LVVWD) the number of applications for new services has plummeted. (Figure 2)
 |
Figure 2. Applications for New Water Services at LVVWD
(Fiscal Year 2010/2011 Operating & Capital Budget) |
This drop may be greater in Las Vegas, but the trend line is similar for many U.S. utilities. Worldwide recession instigated by a financial crises and decline in new construction has substantially impacted water/wastewater utilities. Resources and cost for planning/construction can be reduced and potentially redirected to other priorities such as operational improvement.
Conservation trends also affect utilities’ cash flow and economic viability. No one can argue with the value of conservation for community sustainability, but declining consumption impacts funding operations and new construction. For example, annual water use per customer at LVVWD has declined more than 35% in the last 10 years due to conservation, rate increases, and economic downturn. This affects both water and wastewater utilities, as wastewater system operating revenue is typically tied to water consumption. Rate increases, a common strategy to offset declining consumption and maintain a viable cash flow, are limited in the current environment of recession and economic decline.
Energy Cost
A survey conducted by EMA for the Water Research Foundation (WaterRF) as part of the project “Best Practices for Energy Management,” found energy is a significant operating cost for water/wastewater utilities, ranging from 2% to 35% of operating cost. This equates to substantial cost, in the millions of dollars, on an annual basis.
The cost of electricity, the primary energy source for water/wastewater utilities, has climbed significantly during the past 20 years. (Figure 3) Prices have flattened out recently, but there is little to suggest costs will hold or decrease. The need for electric utilities to expend substantial capital funds to upgrade aging infrastructure and increased generation fuel costs, will drive up rates and the cost of energy.
 |
Figure 3. Increasing Cost of Electricity
(U.S. Energy Information Administration) |
Electricity is an operating cost that is somewhat controllable for utilities where the most effective approach to reducing energy cost is a system-wide approach to energy management.
Water Supply/Quality Management
Water supply remains a significant management issue for many utilities. Drought exacerbates this situation as well as regulations associated with surface/groundwater rules mandated by the Envrionmental Protection Agency. Diverse quality, limited supplies, and cost of raw water for distribution systems intensifies the need for improved operations management. Continuous monitoring and quicker response to disinfection and potential system security events are a goal for most water utilities. As with energy, a systems approach to water supply and water quality operations management yields substantial results.
Workforce Issues
Retirements and other attrition will impact utilities significantly during the next 10 years, as more than 50% of workers leave the industry. A WaterRF/WERF report on succession planning identified large numbers of Baby Boomers will retire, and municipally owned utilities will face staff reductions due to lower billing revenues. This is unprecedented turnover in an industry where workforce stability has been commonplace.
These employees will leave with “tacit” knowledge of system operations, which is understood but undocumented. An Electric Power Research Institute study estimates that in the electric utilities industry, more than 80% of useful operational knowledge is tacit. A more structured, documented approach to system operations is needed to capture and retain this knowledge.
Strategic Operations Automation Planning and Operations Optimization
The economy, reduced operating revenues, energy cost, water supply/quality issues, and succession planning all drive the need to change substantially how water/wastewater utilities operate. This is reflected in EMA’s work in two key areas: Strategic Automation Planning and Operations Optimization.
There are basic commonalities between methodologies used for these types of projects:
- Envision the future operating state of the utility
- Define and characterize the assets that integrate to form the utility system(s)
- Understand current business processes
- Model future business processes• Define the organization, process, and technology requirements to bridge from the current operating environment to the envisioned environment
- Develop a plan to implement the change
- Implement the plan
Process & Organization First, Then Technology
Success depends on people and organizational business process change. Technology is the least important component to implement the plan. We have seen this in the water/wastewater industry and recognize a parallel in the electric utility industry.
A comment David O’Brien, Director of Regulatory Strategy and Compliance for Bridge Energy Group, recently published in his EnergyBiz Blog reinforces this approach when he discusses implementation of the Smart Grid in the electric power industry
“Some may observe that a chicken and egg element exists when it comes to the smart grid. What comes first - the technology or the business transformation? Actually, we have put the cart before the horse. Ideally business evolution is driven first by a vision, and then followed by the tools or technology needed to make the vision become a reality. In a rational sequence the business model is formulated first and the enterprise in question then seeks out the enabling technology to make their plans become reality.”
This has been EMA’s approach to Strategic Automation Planning and Operations Optimization: process and organization driven first, then technology is considered.
Strategic Operations Automation Planning Methodology
EMA’s methodology for Strategic Operations Automation Planning (Figure 4) has been used with numerous water and wastewater utilities on Control System Master Plans.
 |
| Figure 4. Methodology for Strategic Operations Automation Planning |
Step 1: Vision, Business Goals, Strategy define the envisioned future state of utility operations and the objectives for development and execution of the Plan.
Step 2: Utility Infrastructure, Process, and Organizational Requirements drive the organizational, process, and technology requirements for the Plan.
Step 3: Technology and Organizational Solutions identify alternative solutions for implementation of the Plan.
Step 4: Alternative Solution Analysis defines the solutions to be implemented, which are those solutions that will provide the best value and meet the vision, goals, strategies, and requirements.
Step 5: Automation Master Plan provides the approach and roadmap to achieve operational change.
CLIENT CASE STUDIES
Strategic Operations Automation Planning
Several water/wastewater utilities recently developed Strategic Operations Automation Master Plans:
Southern Nevada Water Authority (SNWA)
SNWA developed a Control System Master Plan to define the requirements for the next generation system to monitor and control the Alfred Merritt Smith and River Mountains water treatment facilities and associated transmission system that conveys water from Lake Mead to the Las Vegas valley. A vision for an Operations Management System was created so the new automation system would be designed and implemented to monitor and control future assets and enable optimized operations. Implementation of the Plan is underway with development of a new control system and a focus on efficiency and minimization of energy costs.
Pima County Regional Wastewater Reclamation Department (PCRWRD)
PCRWRD developed a SCADA System Master Plan as a component of their Regional Optimization Master Plan (ROMP). ROMP is a half billion dollar plus plan to improve treatment processes to meet environmental requirements to minimize nitrogen and ammonia in treated wastewater. The business drivers in Pima County’s vision for an Operations Management System are to effectively monitor, optimally control and analyze operations and maintenance of two large and 10 smaller sub-regional wastewater reclamation facilities and associated collection systems. Implementation of the Plan is in progress with the upgrade and expansion of the SCADA system at the large Ina Road Water Reclamation Facility – the first project in the SCADA System Master Plan. New technologies and processes associated with web-based access of data and key performance indicators, SCADA system governance, and change management procedures are also in progress in accordance with the Plan.
Tucson Water
Tucson Water operates large, wide-area water and reclaimed water systems with multiple sources of ground and surface water supply of varying quality. Energy consumption and cost are significant issues for the utility along with attrition of key staff due to retirements. These are business drivers for Tucson Water’s vision of an Operations Management System as part of their Control System Master Plan. This Plan envisions an optimized approach to system operations of the water and reclaimed water systems. Implementation of an Operations Optimization Model with a System Operations Planner/Scheduler (OPS) is in the core of the Plan to more effectively operate and maintain utility system assets and transfer knowledge to future staff.
|
Operations Optimization
An Operations Optimization project may be an outgrowth of an Automation Master Plan or a stand-alone project. It is a way that technology and business processes can be used to address challenges faced by utility managers and operators.
Operations Optimization is the application of a set of operational protocols – formal and written instructions for utility operations – developed into a methodology to significantly improve utility operations.
Supervisory Control and Data Acquisition (SCADA) systems, Laboratory Information Management Systems (LIMS), web-based communication sites, and Geographic Information Systems (GIS) are technology tools that enable utility managers and operators to perform their work more efficiently and effectively. Operations Optimization provides the protocols, or processes, that govern the use of those enabling technologies.
By applying these protocols, it is possible not only to derive the intended benefits from these complex systems, but to “leverage” them through integration, linking them together to develop an automated operational management system that is more than the sum of its parts.
Operations Optimization Model
The Operations Optimization Model (Figure 5) shows the components of daily operations of water and wastewater systems. Developed by EMA for clients and research projects, the model includes: forecasting water, wastewater, and reclaimed water consumption; managing of water supply, water quality, energy, and security; coordinating maintenance/construction; monitoring of system performance; and coordinating with planning/engineering.
Most water/wastewater utilities currently perform all these functions. What is different is the notion of a centralized system operations planning, scheduling, and analysis function responsible for using real-time and historical system operating information to plan and schedule operations every day, and in some cases, every minute of the day.
Operations Optimization: The Objective
The objective is to minimize the cost of operations while maintaining high quality product and system reliability. The key is a rigorous systems approach to operations planning, scheduling, and analysis.
 |
Figure 5. Operations Optimization Model |
The following describes the components within the Operations Optimization Model:
- Utility System Components – The right side of the Model illustrates the components of the utility system, whose operation will be continuously planned, scheduled, and analyzed.
- System Operations Planning/Scheduling/Analysis – This is the core of the Model, as it develops the System Operating Plan. It consists of both people and technology, but the people who create the Plan are the most important component. The daily System Operating Plan is developed using information from the other components of the Model.
- System Operations – Using SCADA and Process Control Systems, this component monitors utility system performance against the Plan and provides feedback for planning/scheduling.
- Forecaster – This is a move from reactive to proactive operations. Water consumption, wastewater generation, and reclaimed water consumption are forecasted on an hourly, daily, weekly, monthly, and annual basis depending on the analysis required.
- Energy Management – Considering energy efficiency and cost, plans and schedules are developed daily considering the time-value of energy and forecasted water/reclaimed water consumption and wastewater generation.
- Water Supply Management – This component considers supply availability, water rights, consumptive use management, quality, cost, and reliability to develop a daily supply schedule.
- Water Reclamation Resource Management – Wastewater is a valuable resource from a supply and reuse perspective, which includes use of reclaimed water, treated wastewater return to rivers and streams, and even generation of electricity using digester gas. These factors are considered in developing daily plans and schedules that can provide substantial payback.
- Water Quality Management – This component brings quality control into daily operations planning and scheduling. Water quality information from SCADA/LIMS is monitored continuously and evaluated real-time, providing quick response to potential water quality events and to assist in daily planning and scheduling of system operations.
- Security Management – Continuous analysis of SCADA data, water quality data, electronic systems status, and equipment maintenance status.
- Maintenance and Construction Coordination – Maintenance and construction of assets that affect system operations are known by the Operations Planner and Scheduler, who reviews equipment clearance requests and advises when and if the work can be conducted to maintain system reliability and minimize operating cost.
- System Performance Monitor – automatically monitors conformance to the System Operating Plan and the utility’s Key Performance Indicators (KPIs).
- Utility Planning and Engineering Coordination – Development of utility operating criteria is a key collaborative function between the Operations Planner and Scheduler and Utility Planning and Engineering. Performance of the system against KPIs should be monitored and analyzed by the operations planner, utility system planner, and engineer. Operating costs as well as water, wastewater, and reclaimed water systems performance are highly dependent on and sensitive to these performance criteria. The Operations Planner and Scheduler will generate reports which document compliance to the criteria. These reports will also be used to justify modifications to the criteria if necessary.
Operations Planner and Scheduler also will be involved in the creation and modification of the Master Plan, Asset Management Plan, Capital Improvement Plan (CIP) and new facility design.
CLIENT CASE STUDIES
Operations Optimization
The following water and wastewater utilities have implemented Operations Optimization program, that range from one or many of the components in the Operations Optimization Model.
JEA (Jacksonville)
JEA implemented a real-time adaptive Operations Optimization system that controls wells and distribution system pumping of the water system based on water supply, water quality, and energy management. Substantial savings in capital costs have been achieved by more optimized use of installed water system assets.
Metro Vancouver
Metro Vancouver implemented an Operations Optimization program to proactively operate the water system considering construction and operation of the new Seymour-Capilano Water Filtration Plant. A System Planner Scheduler function was implemented to plan and schedule system operations more effectively considering water supply, water quality, energy consumption/production, and maintenance/construction scheduling.
San Diego Water Department (San Diego)
San Diego implemented an Operations Optimization program to better manage multiple water supplies and energy costs. In the first year of operations, the Optimization Group reduced water supply and energy costs by $1.1 million.
Seattle Public Utilities (SPU)
SPU first implemented an Operations Optimization program in the water system. Water supply, treatment, and pumping operations are planned, scheduled, and coordinated by an Operations Planner and Scheduler group using a web-based system operating plan. Water quality data is analyzed in real-time using Water Quality Analyzer software program. Wastewater/Drainage has implemented a System Operations Planning and Analysis group to better manage operations of the combined/sanitary sewer and drainage systems.
Scottsdale Water Department
Scottsdale operates a complex utility with water, wastewater reclamation, reclaimed, and irrigation systems. The planning phase of the Operations Optimization program has been completed, and deployment has commenced with the start-up of Operations Planning and Scheduling and System Operations functions. Objectives of the program are to continuously improve utility operations, transfer knowledge through structured planning/scheduling/analysis, and minimize cost.
El Paso Water Utilities (EPWU)
EPWU negotiated and implemented new time-of-use and interruptible electrical rates which required significant changes to water and wastewater operations. By considering a systems operating approach to energy management, EPWU saved $2.7 million in annual energy costs in the first year on the new rates.
|
When water system operations are optimized, some of the assumptions traditionally used in the development of the long-term plans will be tested and potentially changed.
By improving the operational efficiency of the constructed water, wastewater, and reclaimed systems, it may be possible to downsize, defer, or even cancel certain anticipated projects and CIP improvements. Daily planning, modeling, and optimization may also identify the need for new facilities, which have a very positive return-on-investment. This level of coordination between the operator, planner, and engineer can yield a significant financial payback of an Operations Optimization program.
Structured Methodology for an Operations Optimization Program
|
| 
|
Figure 6. EMA's methodology for Operations Optimization has been used with
numerous water and wastewater utilities for the last 15 years. |
Figure 6 illustrates a methodology for Operations Optimization programs developed over the last 15 years. It is a scalable methodology that can be used for one or many of the components of the Operations Optimization Model. The most important aspect of all referenced programs in this article is a utility-wide, systems view of optimization – organization and process first – then the appropriate technology. The results can be substantial improvement in daily operations.
BACK TO TOP
e-FLUENT
Sharing, Safety
Incorporating Defense in Depth into Data Sharing Strategies
Bob George
Principal Consultant
|
|
Access to SCADA and control system data is becoming essential to most utilities as part of operational efficiency strategies. The challenge is whether to make data from our most critical systems available to outside users, and if so, how to do it without compromising security.
It must be understood that there is no “zero-risk” strategy. Any exposure to the outside brings associated risk. What we can do is minimize that risk to possibly acceptable levels. The key is “defense in depth.” Your strategy should consist of multiple complementary and independent controls:
Controls are the security measures – policy, firewalls, detection systems, etc. – that we implement to protect our systems.
- Multiple controls ensure that a single failure does not compromise our entire operation. No single means of securing your network is sufficient. While a firewall is still a key component in any security strategy, it should be supplemented by monitoring and application security measures.
- Complementary controls provide coverage in weaknesses in the others. Some overlap of function is needed between layers to ensure that a failure in any one layer will be detected by another.
- Independent controls are capable of providing coverage in the event another fails. At minimum, a default “secure” configuration should be provided if any control fails.
A corollary of this definition is:
When defense in depth is applied, no direct access is allowed from a less trusted network to a more trusted network.
Don’t assign too much significance to the words “trusted” and “untrusted” in this context. Substitute words such as “inside” and “outside,” “SCADA” and “non-SCADA,” or other less-charged terms if this is a problem. The trusted and untrusted designations only relate to the authorized flows of traffic. They do not imply any moral judgment of our colleagues in other departments or organizational groups. Don’t let these terms take on any political significance.
Here’s an example of a defense-in-depth strategy for sharing SCADA data with business applications:
 |
Figure 1. Example of defense-in-depth strategy for sharing SCADA data with business applications |
In greatly simplified terms, data is shared across multiple zones, each protected by one or more security controls (Figure 1):
1. A subset of data from the SCADA database is pushed from the inside, trusted SCADA network to a DMZ-based database server. Only the data needed for external consumption is pushed. The SCADA firewall prevents traffic originating from other networks from entering the SCADA network.
2. The DMZ-based Web Application Server is allowed to query the subset of data on the DMZ-based Database Server. Traffic between DMZs is limited to only that necessary for operation of the application.
3. Business users are allowed to make web queries to the DMZ-based Web Application Server. No other traffic is allowed into the DMZ.
In this example, we have multiple protections:
- Dual firewalls provide defense in depth, protecting both the SCADA and business networks.
- The flow and direction of data between networks are minimized.
- DMZ-based servers are hardened, with default accounts and services limited, and updates applied regularly.
Depending on the scenario, additional complementary controls can be applied:
- Authorized login credentials can be required to allow access to the web application server.
- Multi-factor authentication (tokens) can be used to restrict remote user access.
- Flows of traffic between networks can be monitored.
BACK TO TOP
|