The Critical Role of Cybersecurity in Keeping Public Works Infrastructure Operational

The American Public Works Association (APWA) is a professional association of more 30,000 members across the United States and Canada, responsible for “making normal happen” in the communities they serve. While the structures may vary from area to area, all communities have public works at some level. Depending on the community, these quiet public works professionals can cover a wide range of responsibilities including drinking water production and distribution, wastewater collection and treatment, storm water management, roads and highways, parks and nature areas, public facilities and buildings, fleet management, transit, solid waste, airports, and more.

The vital work that public works professionals do every day is so normalized that sometimes even other first responders forget about the role that public works plays to make sure that drinking water (as well as fire suppression and public health) is uninterrupted, wastewater is collected and treated (vital for public health and facility operation), storm water systems operate as designed (can play a role in hazmat situations), and transportation networks are operational so all resources can get where they need to be. The role that public works professionals provide in constructing, operating, and maintaining some of the critical lifelines for their community cannot be understated, but protecting those critical lifelines is a collaborative effort between many groups in both the public and private sectors.

Just like the Internet of Things (IOT) has become ingrained in everyday life for many people, it also continues to become more and more integrated into public works operational systems. Cybersecurity is a critical issue for public works for a number of reasons. The systems that are in place to construct, operate, and maintain critical infrastructure all have some components of technology involved. Some of the ways that connected technology is integrated ranges from things as simple as databases used to store information, to supervisory control and data acquisition systems (SCADA), or control systems for irrigation or athletic field lighting. The challenge in protecting these systems from cyber threats comes from the varied ways in which they are connected to networks and thus the hardware and software barriers, as well as who is managing them, is not consistent. This is really where the collaborative effort of the public and private sectors must join alongside public works in assisting with cybersecurity. How those efforts look will depend on the systems and needs of individual public works departments, but even just assessing the cyber threats and vulnerabilities would be a good starting point.

Beyond the cyber-actor threat, preparing for a disaster or other unplanned event is another layer to cybersecurity, in the sense that redundancy of these systems is also vital. Because computer network systems are just that connected, any one of those computers serves as a potential failure point. But this issue applies to more than just public works. For example, some public works radio communication systems, such as 800mhz land mobile radio, are supported by networks and if those systems are compromised for whatever reason critical communication abilities can be lost. Similarly, cellular networks provide vital communication and operational control of critical infrastructure. If the cellular network is overwhelmed or has failed, public works professionals still need to have operational control of the critical infrastructure facilities. For cellular networks, this is one of the essential reasons that including public works in the FirstNet program is vital to the operational readiness of our communities. For public works, it is not just about communication but being able to monitor and operate critical infrastructure facilities via the cellular network.

Outside of cybersecurity efforts for systems, one of the ways public works departments assist preparedness is by spreading the word of cybersecurity awareness through social media accounts. While cybersecurity is not the core of the public works mission, we can help prepare our communities by sharing the important messages to our followers. This would not be possible without the effort and production of educational materials (social media and otherwise) by other public, private, and nonprofit groups. But this joint-effort education model with the Department of Homeland Security, and other partners (public, private, nonprofit) developing important messages and public works sharing them has many applications beyond just cybersecurity as it relates to all hazards. Leveraging these collaborations during non-emergencies, for topics such as cybersecurity, is a great way to develop and exercise these relationships for when disaster strikes.

In addition to the cyber realm, physical security is another big factor for public works. Some people see physical security as fences, locks, and bollards, but it is so much more than that and most of it happens every day. Ensuring the physical security of critical infrastructure systems must occur on many levels. One of the big challenges in security is based on who is encountering the critical infrastructure. For the general public it is more an issue of safety, and this is where features such as fences and locked doors are utilized. But along roads and highways there is another potential security measure that some may not normally recognize as physical security – guardrails and concrete walls. It is true that these devices are intended to keep errant vehicles on the road for the occupant’s safety from whatever is off the road, but they also serve to protect roadside facilities such as communication buildings, radio towers, and road weather information systems from errant vehicles.

For operators, contractors, or other authorized personnel involved in critical infrastructure there are    processes in place intending to provide a layer of security. Some communities require anyone working in or placing facilities in the public right of way to get a permit. This permitting process allows the local unit of government to know what proposed action will be taking place, who a contact is, and to be able to manage the process as appropriate. If conflicts, or other issues, are identified as part of the permitting phase, then costly delays or emergencies during construction can be avoided. Another key security feature that is widely advertised is the 811 Call Before You Dig (One Call Systems International). Calling before an excavation takes place is required under state law across the United States. When someone calls 811 and communicates their proposed excavation location and scope of work, the local utility companies in the area are notified of the work and required to go mark the location of existing underground utilities using paint and/or flags. This way the person or company doing the work has an idea of the potential conflicts they need to watch for while digging. The utility locate process is key in providing for physical security of critical infrastructure, including cyber, because so much of the communications backbone runs along fiber networks buried below the ground. One simple scoop of an excavator could rip a fiber line(s) right out of the ground and the system that line was supporting would be rendered useless until repairs are made or a redundant system made operational. For public works, even the permitting process for work in the public right of way has a role in providing for critical infrastructure protection.

The operations side of public works also has many layers of security that are seemingly basic or routine. For water (drinking and waste) treatment systems this includes regular monitoring and testing. Backflow preventers can be used to make sure that water does not flow the wrong way through a pipe system. The important thing to note with these devices or practices is that because they are routine, it is important that the public works professionals doing the work do not become complacent. This shared mindset of security is an area where that can really provide an opportunity for public works and other security professionals to come together.

Public works professionals work to “make normal happen” in their communities on a daily basis and have a key role in preparing for, mitigating against, responding to, and recovering from disasters or other events (planned or unplanned). When things go bad, it is the critical lifelines that public works provides that need to be restored for actual recovery to begin. The role of cyber and physical security in preparing for all hazards is continually evolving. It is only through strong partnerships and collaboration at all levels between public works professionals and others in the homeland security enterprise that the United States can become a more resilient nation.

Mark Ray is Director of Public Works for Crystal, Minn., and chairman of the Emergency Management Committee, American Public Works Association.

Leave a Reply

Latest from Cybersecurity

Go to Top
Malcare WordPress Security