WASD continues to monitor cyber-threat assessments, while ensuring safe delivery of drinking water

In light of the recent hacking of a water treatment plant in the City of Oldsmar, Florida, the Miami-Dade Water and Sewer Department (WASD) wants to assure its customers that the processes, protocols, and safeguards in place at its three regional water treatment plants are designed to minimize any possible service interruptions or possible impact to water quality standards.

In addition to a security defense in depth approach including, firewalls, ongoing upgrades and a patch management program, there are a limited number of credentialed staff who have access to the department’s monitoring/control system, and staff must navigate through multiple layers of authentication to gain access.

“As the largest water and sewer utility in the Southeastern United States, we are naturally concerned when an event like this occurs,” said WASD Interim Director Jose Cueto. "Our department is prepared to defend against cyber threats, and this reinforces our on-going commitment to partner with the Miami-Dade County’s Information Technology Department (ITD) to monitor the ever-changing nature of cyber threats against critical infrastructure and conduct vulnerability assessments to introduce additional safeguards as needed.”

Ensuring the safety of the public drinking water supply is not just monitored at the local level.

“The County and WASD communicate with law enforcement agencies at the local, state and federal levels and share information so we can all remain current on the threats that governments and critical infrastructure face,” said ITD’s Chief Information Security Officer Lars Schmekel. “This is an ongoing process that involves the continuous review of established policies and protocols to counteract emerging threats.”

In addition to automated alarms associated with various water treatment process parameters, department staff monitor water treatment operations 24 hours a day. WASD staff also collect physical samples – independent of automated readings taken by sensor - throughout the water treatment process at two-hour intervals. These controls ensure that water quality being produced at the facility always meet public health standards.

In 2019, the Department’s Supervisory Data Acquisition and Control (SCADA) Division performed a Department of Homeland Security Cyber Resilience Review self-assessment. As a result of this self-assessment, areas of improvement were discovered, and some of the necessary enhancements have been implemented.

Furthermore, in November of 2020 WASD completed a Risk and Resilience Assessment (RRA) as required by the America’s Water Infrastructure Act (AWIA) for all community water systems. Department staff and representatives of partner agencies evaluated all critical system assets and the risks imposed by the full spectrum of threats and hazards that can impact utility operations. The assessment effort included evaluation of cybersecurity risks associated with those systems using industry cybersecurity standards and best practices. As a result of this effort the department has a greater understanding of the strengths of existing systems/practices and has a roadmap for addressing identified shortfalls.

It is the priority of the Miami-Dade Water and Sewer Department to provide safe, reliable service to its customers. For additional information about Department services and programs, visit the WASD website.