Ensuring Water Supply Security in Smart Cities: A Multi-Layered Defense

Water supply systems represent some of the most critical infrastructure in any city. From reservoirs and treatment plants to miles of underground pipelines, these systems serve millions of people daily-but they also present vast security challenges. In smart cities, where digital connectivity amplifies both efficiency and vulnerability, protecting water infrastructure demands a comprehensive, multi-layered defense strategy that addresses physical threats, community engagement, and increasingly sophisticated cyber attacks.

Physical security: the first line of defense 🔗

Physical security forms the foundation of any water supply protection strategy. Leading organizations in the water sector-including the American Water Works Association (AWWA), the American Society of Civil Engineers (ASCE), and the Water Environment Federation (WEF)-advocate for what security professionals call a “security in depth” approach. This methodology creates multiple protective barriers that an intruder must overcome, making unauthorized access progressively more difficult.

The security in depth framework typically encompasses four distinct layers. The first layer is the facility perimeter, which includes fences, gates, walls, and barriers that establish the initial boundary. The second layer covers the site grounds-the area between the perimeter and actual buildings, often monitored through patrols and surveillance systems. The third layer protects individual buildings such as treatment plants, pump houses, and control centers through reinforced doors, access control systems, and security personnel. The fourth and innermost layer safeguards internal building systems, including equipment cages, locked control panels, and restricted access to critical machinery.

This layered approach serves two primary purposes: to deter potential intruders by presenting visible security measures, and to delay any intrusion long enough for response teams to intervene. Even when one layer is compromised, subsequent layers continue providing protection.

Source water security and community vigilance 🔗

Protecting source water-whether from rivers, lakes, reservoirs, or underground aquifers-presents unique challenges due to the often-remote locations and vast areas involved. The primary strategy involves isolating water sources and restricting public access to sensitive areas. Fencing around reservoirs, restricted zones near intake structures, and patrol routes along vulnerable stretches all contribute to source water protection.

However, physical measures alone cannot cover every potential threat. This is where community engagement becomes invaluable. The EPA’s Source Water Protection Program emphasizes that residents who live near water sources can serve as additional eyes and ears for utilities. Public awareness campaigns educate community members about what constitutes suspicious activity around water infrastructure.

Community members can be trained to recognize and report concerning behaviors such as unauthorized dumping of chemicals or waste materials near water sources, individuals trespassing in restricted areas or tampering with fencing, people photographing or recording facilities without apparent legitimate purpose, and unusual vehicles or equipment near intake structures. Many utilities incorporate these reporting tips directly into customer billing statements, reaching every household in the service area. Some also establish dedicated hotlines for reporting suspicious activities, creating a direct link between concerned citizens and security personnel.

Securing untreated water storage and transport 🔗

Pump stations, intake structures, and raw water storage facilities represent critical nodes in the water supply chain. These fixed installations can employ traditional security measures effectively, including perimeter fencing, access control, and security lighting. However, the infrastructure connecting these nodes-aqueducts, canals, and pipelines that may stretch for miles through remote terrain-poses significant monitoring challenges.

For lengthy transport systems, technology becomes essential. CCTV camera networks positioned at strategic intervals enable a small security team to monitor vast areas effectively. Modern systems incorporate motion detection, night vision capabilities, and remote access, allowing operators to survey pipeline corridors without deploying personnel to every location.

Smart sensors integrated along pipeline routes can detect anomalies such as pressure drops (indicating leaks or tampering), unauthorized access to valve stations, and unusual flow patterns. These sensors feed data to centralized control systems, enabling rapid response to any detected issues. The key advantage is that technology extends human monitoring capabilities across distances that would be impractical to patrol physically.

Treatment plant and finished water storage security 🔗

Water treatment plants represent ideal candidates for comprehensive security implementation. As static, bounded facilities, they can fully employ the four-layer security model discussed earlier. Treatment plants house critical processes that transform raw water into safe drinking water, making them high-priority protection targets.

Enhanced security measures at treatment plants typically include perimeter fencing with anti-climb features and intrusion detection systems, electronic access control systems requiring credentials for entry, closed-circuit television monitoring of all critical areas, motion detectors and alarm systems, automatic lighting that activates upon detecting movement, and secured storage for treatment chemicals to prevent theft or sabotage.

Finished water storage and distribution 🔗

Finished water storage facilities-elevated tanks, reservoirs, and ground storage tanks-require similar protections. These structures hold treated water ready for distribution, making any contamination at this stage particularly dangerous. Security measures combine traditional physical barriers with technology-enabled monitoring.

Distribution systems, comprising the network of pipes and valves delivering water to consumers, present distributed security challenges similar to raw water transport. Collaboration with local law enforcement can extend monitoring capabilities across the distribution network. Regular patrols near key infrastructure, joint training exercises, and information sharing between utilities and police departments create an integrated approach to distribution system security.

The real threat of cyber attacks 🔗

While physical security has long been a focus for water utilities, the digital transformation of water systems has introduced entirely new threat vectors. Modern water treatment and distribution increasingly relies on supervisory control and data acquisition (SCADA) systems, programmable logic controllers, and network-connected sensors-all of which can potentially be compromised by malicious actors.

Recent incidents have demonstrated this vulnerability dramatically. In October 2024, American Water-the largest regulated water utility in the United States-was targeted by a cyber attack that forced the company to disconnect its customer portal and pause billing operations. Multiple water facilities in Texas experienced attacks from hackers who accessed SCADA systems remotely and manipulated settings. In one notable case, an operator who noticed his mouse cursor moving independently was able to prevent hackers from adjusting chemical levels in the water supply.

The EPA has issued enforcement alerts warning of alarming cybersecurity vulnerabilities across the water sector. Agency inspections revealed that over 70% of water systems failed to fully comply with basic security requirements. Common problems included utilities that never changed default passwords, systems where all staff shared a single login, and access credentials that remained active for former employees.

Nation-state threats 🔗

The threat landscape has expanded beyond opportunistic hackers to include sophisticated state-sponsored actors. Federal agencies have attributed various attacks on water infrastructure to actors linked to Iran, Russia, and China. The FBI has warned that Chinese hackers have penetrated deeply into U.S. cyber infrastructure targeting water treatment plants, electrical grids, and transportation systems.

Pro-Russia hacktivists have increasingly targeted industrial control systems within water utilities, often exploiting basic security gaps such as default passwords and unsecured remote access points. These attacks may currently cause relatively limited direct harm, but security experts warn that in worst-case scenarios, cyber intrusions could be coordinated with physical attacks-for example, triggering backflow events that could contaminate drinking water supplies.

Building cyber resilience 🔗

CISA and the EPA have developed comprehensive guidance for water utilities to strengthen their cyber defenses. Key recommendations include reducing exposure of systems to the public internet, conducting regular cybersecurity assessments, implementing multi-factor authentication, properly segmenting IT and operational technology networks, and developing and practicing incident response plans.

AWWA has developed specific cybersecurity risk management tools to help water utilities comply with America’s Water Infrastructure Act requirements while building genuine security capabilities. These resources help systems of all sizes-from small rural utilities to major metropolitan providers-implement appropriate protections within their budgets and technical capacities.

Integrating physical and cyber security 🔗

The most effective water supply security programs recognize that physical and cyber threats are increasingly interconnected. A compromised security camera system could blind operators to physical intrusions. Conversely, physical access to control systems could enable cyber attacks from within the network perimeter.

CISA advocates for a layered approach to cybersecurity that mirrors the physical security in depth model-using multiple protective measures so that no single point of failure can compromise the entire system. This includes technical controls, security policies, employee training, and partnership with federal agencies that can provide threat intelligence and incident response support.

For smart cities, where water systems increasingly connect to broader urban infrastructure networks, security integration becomes even more critical. Water treatment plants may share data with city emergency management systems, smart sensors may communicate with traffic management infrastructure, and billing systems connect to municipal financial networks. Each connection point must be secured against potential exploitation.

What do you think? As cities continue digitizing their water infrastructure to improve efficiency and service, how should utilities balance the benefits of connectivity against the security risks it introduces? And what role should ordinary residents play in protecting their community’s water supply?

References

1. https://www.awwa.org/resource/risk-resilience/
2. https://www.epa.gov/sourcewaterprotection
3. https://www.epa.gov/sourcewaterprotection/source-water-protection-practices
4. https://masstank.com/guide-to-potable-water-tank-standards/
5. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector
6. https://smartwatermagazine.com/news/smart-water-magazine/water-sector-cybersecurity-2024-high-stakes-and-urgent-responses
7. https://www.epa.gov/enforcement/enforcement-alert-drinking-water-systems-address-cybersecurity-vulnerabilities
8. https://www.cnbc.com/2024/10/08/american-water-largest-us-water-utility-cyberattack.html
9. https://www.ibm.com/think/news/cyberattack-on-american-water-warning-critical-infrastructure
10. https://www.cisa.gov/water
11. https://cybersecurity.awwa.org/
12. https://www.cisa.gov/national-critical-functions-supply-water-and-manage-wastewater