Cybersecurity: keeping your automation system safe

Learn about the threats cybercrime present, and the measures taken to mitigate these impacting your automation system, in our latest blog by Niels Tiemessen.

Two man looking at a screen disucussing the topic


Niels is a product expert and business developer at Royal HaskoningDHV. With over six years' experience in the water sector, hes introduced automation solutions, specialising in industrial wastewater treatment plants. He’s passionate about optimising processes, reducing costs, and promoting sustainability through automation

Despite the many benefits of introducing process automation solutions at industrial wastewater treatment plants (WWTP), a concern that always comes up during the initiation of any new digital project is around cyber security. Continuing in our series of articles about advanced process control (APC) solutions for industrial WWTP, Niels Tiemessen, product expert and business developer at Royal HaskoningDHV, takes a look at cybersecurity and plant safety with regards to system hacking.

Threats from cybercrime

Any industrial or municipal WWTP, or any other asset that is connected to a network, can be subject to threats from cybercrime, with tremendous potential damages, especially when local control is compromised. The most obvious solution to eliminate any type of remote risk is to have a local control system (SCADA/DCS) that is not reachable through the internet. However, with more businesses enabling remote working, especially since Covid, and also not wanting to have to staff the control room outside of office hours, this is not an option anymore.

You only need to look at the Wikipedia page of Cybersecurity, to see that the list of threats and defenses is rather overwhelming, requires expert knowledge and would be impossible to cover in a short blog. To gain a more detailed insight on our view on this matter, please read our Whitepaper on managing cybersecurity.

Following standards inside and outside the organisation

It goes without saying that there are numerous ways of mitigating cybersecurity concerns, and probably even more frameworks to guide organisations. Some of the most popular standards are the NIST (National Institute of Standards and Technology) and ISO27001. What is essential, is to not only make sure that your own organisation follows the guidelines of these frameworks, but also the supplier of your APC software does too, and ensure that the auditing and certification process has taken place.
NIST Cybersecurity framwork explainer

Aqua Suite: Safe by design

Any type of control solution starts with the fundamental question of how the automation is executed. Even though there are certain benefits to hosting cloud control applications – like a shorter version release cycle – most Aqua Suite solutions are hosted on the premises. This means a dedicated (virtual) Windows server is set-up within the client’s safe environment. It also means that the connection with SCADA/PLC/DCS is direct and not over the internet. Because there are many different protocols, like OPC-UA, Modbus etc, clients need to ensure that their providers support their existing OT. While not strictly necessary, it is still recommended to have an (on-demand) external connection, so Royal HaskoningDHV’s experts can undertake remote monitoring and updates, and the client can enjoy the benefits of cloud-based advanced analytics.
Automation execution Twinn Aqua Suite table

Operational safety and cybersecurity are different things

While cybersecurity measures need to ensure that an organisation stays safe from malicious intentions, this doesn’t automatically mean that the software itself is safe and robust to use. Since actual setpoints, and not just insights, are provided to the local control system, it is highly advisable to determine whether the various necessary built-in safety measures are present.

These include a Watchdog that monitors the connection between the APC software and SCADA/PLC. When this connection is lost, process control should automatically revert to traditional, local control. Since all APC solutions depend on online measurements, extra safeguarding for when these measurements are unreliable or missing is crucial as well. Anomaly detection could provide additional insights on when things like sensor drift start to occur and help to improve maintenance and data quality. Also, the fundamental type of machine learning model and algorithms determines the robustness of an APC solution. Despite providing great modelling insight, black box models often need long (re)training times and are influenced by different actions from operators, leading to potentially higher downtime, especially when the line-up of a system changes. A more grey-box type of approach could be more favourable. This is where the fundamental working principles, based on deep domain knowledge, are ingrained in the algorithms themselves, and not learned by the AI.

While cybersecurity measures need to ensure that an organisation stays safe from malicious intentions, this doesn’t automatically mean that the software itself is safe and robust to use.

Niels TiemessenProduct expert Twinn Aquasuite

How to keep your water data secure in a cloud-first world

This whitepaper explains the different approaches to deal with cybersecurity and provides a detailed checklist when deploying automation systems.
Download now
Download cyber security white paper
Find out more about how Twinn Aqua Suite can help improve industrial WWTP performance and help the industry tackle the skills shortage. Or, get in touch with Niels Tiemessen for more information.
Niels Tiemessen - Product expert Twinn Aqua Suite


Product expert Twinn Aqua Suite