Developing a Security Program

1
Developing a Security Program
2
Developing a Security Program
Develop/Update Plan

• Exercise Plan

Review/Revisit Plan
3
Developing a Security Program

• Understanding One Size Does Not Fit All
• The Importance of Being Prepared
• Why Communication is the Key
• Ten Key Security Program Principals
• What Resources Are Available

4
One Size Does Not Fit All

• Utility security programs should achieve
  consistent outcomes using utility-specific
  strategies.
• Implement approaches that are tailored to your
  utilities circumstances and operating conditions.

5
(No Transcript)
6
Security Program Scope

• Active and effective security programs should
  address
• protection of public health
• public safety (including infrastructure)
• and public confidence

7
(No Transcript)
8
Significant System Failures

• An active and effective security program should
  consider
• Loss of pressure for significant parts of the
  system.
• Long term loss of supply, treatment, or
  distribution system.
• Adverse impacts to public health or confidence
  resulting from a contamination threat or incident.

9
(No Transcript)
10
Key Threats or Methods of Attack

• When developing an active and effective security
  program you should consider
• Physical targeting of core facilities or
  independent infrastructure
• Chemical or biological material used to
  contaminate water supplies
• Cyber attack on technology assets to disrupt
  services

11

• All hoaxes must be treated as actual events
  until proven otherwise

12
A Part of Being Prepared

• Commitment to security
• Promote security awareness
• Up-to-date assessment of vulnerabilities
• Dedicate security resources and security
  implementation priorities
• Define security roles and employee expectations

13
(No Transcript)
14
Being Prepared Continued

• Intrusion detection and access control for the
  physical plant, and/or at the source(s)
• Contamination detection
• Information protection and continuity
• Design and construction
• Threat level-based protocols

15
(No Transcript)
16
Communication is the Key

• Emergency response and recovery plans should
  incorporate security considerations and be tested
  and reviewed regularly.
• Internal and external communications.
• Partnerships

17
(No Transcript)
18
10 Key Security Principles

1. Security should be part of your utilitys
   day-to-day thinking.
2. A strong commitment to security is key.
3. There are always ways to improve security.
4. Prevention is a key aspect of enhancing security.
5. Movement towards practices that are inherently
   safer.

19
10 Key Security Principles

1. Ongoing management and monitoring, and budget
   commitment.
2. Security issues should be a factor in building
   plans and design.
3. Security may not be convenient.
4. Build strong relationships with response partners
   and the public.
5. You have to put a price on security.

20
Resources

• Technical Assistance Providers
• National Environmental Services Center
• www.nesc.wvu.edu
• National Rural Water Association
• www.nrwa.org
• Rural Community Assistance Partnership
• www.rcap.org
• Safe Drinking Water Trust eBulletin
• www.watertrust.org

21
Additional Resources

• American Water Works Association
• www.awwa.org
• Association of State Drinking Water
  Administrators
• www.asdwa.org
• National Drinking Water Clearing House
• www.ndwc.wvu.edu
• U.S. Environmental Protection Agency
• www.epa.gov