WaterISAC to Host Two Webcasts to Help Utilities Reduce Cyber Risks to IT and Industrial Control Systems

WaterISAC is hosting two webcasts in July and August about cybersecurity best practices, services, and tools. These webcasts are open to members and non-members without charge.

1.         NIST Cybersecurity Framework, Getting Started in the Water Sector

 

DATE:  Tuesday, July 22, 2014

TIME:   2:00-3:15 PM (eastern)

REGISTER:  Click this link Register Now

The NIST Cybersecurity Framework is a set of best practices derived from consensus-based IT and industrial control systems security standards. Water and wastewater systems are not legally required to implement the Framework, but the Federal government is urging all critical infrastructure owners and operators to do so voluntarily in order to reduce their risks from possible cyber attacks against their IT and industrial control systems.

The goal of the webcast is to help the water sector get started using the Framework by providing attendees a basic understanding of its components and recommendations. The webcast will also highlight various programs, guidance and tools to help the water sector implement the Framework, such as the AWWA Cybersecurity Guidance & Tool.

 

2.         Cybersecurity Assessments and Tools by DHS

DATE:  Wednesday, August 20, 2014

TIME:   2:00-3:00 PM (eastern)

REGISTER:  Click this link Register Now

Cybersecurity services and tools offered by the U.S. Department of Homeland Security (DHS) include free, confidential onsite cybersecurity assessments conducted by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) as well as the Cyber Security Evaluation Tool (CSET). CSET is a downloadable tool developed by cybersecurity experts under the direction of ICS-CERT to help users assess the security posture of their cyber systems and networks.

Presenters will also discuss the Cyber Resilience Review (CRR) provided by DHS’s U.S. Computer Emergency Readiness Team (US-CERT). The CRR measures the operational resilience of a specific critical service to provide participants with a detailed report containing options for consideration. It is a voluntary assessment that can either be conducted via a facilitated one-day workshop or as a self-assessment; the CRR Self-Assessment Kit is meant to complement the NIST Cybersecurity Framework.

QUESTIONS?  Contact WaterISAC if you have any questions about either webcast.

EPA Responds to Community Flood Concerns

Earlier today, Joel Beauvais, Associate Administrator for EPA’s Office of Policy, made the following announcement.

EPA’s Office of Sustainable Communities recently released a report and a handy checklist that communities seeking to prepare for or recover from a major flood can use to assess whether their codes, policies, and regulations can help them withstand floods.

The report and checklist cover a wide range of activities. Not all of these activities will be appropriate for each community. However, community leaders may want to consider them all and then choose the activities that work best for their local conditions and circumstances.

Here are some general steps communities can take to improve their flood resilience:

  • Update and integrate community or comprehensive land use plans with hazard mitigation plans to ensure they are coordinated and that they prioritize planning for new growth in safer areas.
  • Audit policies, regulations, and budgets to ensure consistency with flood-resilience goals outlined in community plans and hazard mitigation plans.
  • Amend existing policies, regulations, and budgets or create new ones to help achieve the flood-resilience goals outlined in plans.

Here are some specific local land use policy options communities can consider:

  • Conserve land and discourage development in particularly vulnerable areas along river corridors, such as flood plains and wetlands.
  • Where development already exists in flood-prone areas, take steps to protect people, buildings, and facilities from flooding risks.
  • Plan for and encourage new development in areas that are less vulnerable to future floods.
  • Manage stormwater using watershed-wide stormwater management and green infrastructure approaches to slow, spread, and infiltrate floodwater.

State agencies can also partner to support recovery and flood-resilience planning. Specific actions states can take to improve their flood recovery and resilience efforts include:

  • Auditing all state programs to determine how well they help communities achieve flood-resilience goals.
  • Developing a comprehensive recovery plan before the next flood happens.
  • Developing a personnel plan that delineates who will assist with post-disaster recovery.

The checklist and report come on the heels of President Obama’s announcement on June 14 of a new National Disaster Resilience Competition, which will provide nearly $1 billion in funding from the U.S. Department of Housing and Urban Development’s Community Development Block Grant-Disaster Recovery funds to help communities that have experienced natural disasters rebuild and prepare for future disasters. The Notice of Funding Availability for the competition will be posted on www.hud.gov.

The Office of Sustainable Communities will host a webinar on smart growth approaches for flood-resilient communities with FEMA and the state of Vermont on Wednesday, August 13, from 1:00-2:30 EDT. Find details at http://www.epa.gov/smartgrowth/webinars/index.html.

EPA WSD Creates Newsletter

Welcome to the first edition of “What’s Going On” from the EPA’s Water SecurityDivision. Please feel free to distribute these preparedness resources to your water

utilities and partners.

 

EPA WATER SECURITY DIVISION:  WHAT’S GOING ON?

 

image002Boost Your Disaster Funding
EPA’s Federal Funding for Utilities – Water/Wastewater – in National Disasters, known as Fed FUNDS, helps you understand federal disaster and mitigation funding.Visit www.epa.gov/fedfunds.
image002Don’t Get Soaked!
EPA’s “Don’t Get Soaked” video can help you talk to decision makers about the importance of investing in preparedness, prevention and mitigation activities.Watch it at www.youtube.com/watch?v=kPK9j2S5TwE.
image003Face Floods with Confidence
Coming soon! EPA’s Flood Resilience Guide offers easy-to-use aids to help you look at the threat of flooding, determine impacts to utility assets and find cost-effective mitigation products for flooding events.
For more water security tools and resources, visithttp://water.epa.gov/infrastructure/watersecurity.

WaterISAC Webinars on PN During Events

If you are a WaterISAC subscriber…

Please join WaterISAC on July 9 and 10, 2014 for a two-part webinar on public notification during water contamination events and outages.

Drinking water contamination and outage events often necessitate an extensive communication effort. Yet water systems routinely employ a regulatory framework based on the Public Notification Rule and other requirements to communicate risk. High profile events from the West Virginia chemical spill to natural disasters, as well as experience from main breaks and rule violations, suggest that some events demand more than just the regulatory communication framework to meet the needs of customers and communities.

Among the tools developed to help utilities communicate better in such situations is the Drinking Water Advisory Communication Toolbox, created by the Centers for Disease Control and Prevention, along with AWWA and U.S. EPA. This two-part webinar will discuss how to use the Toolbox and other best practices for advancing utility communications. Both sessions will cover different scenarios and use a range of utility experiences.

  • Part 1 (Wednesday, July 9, 2-3 PM ET) - The first session will address communication planning and evaluation. Discussion will include the differences between messages and information, preparing to respond to unknowns, and public health sector and health effect concerns.

Register for Part 1 (WaterISAC Pro Members only)

  • Part 2 (Thursday, July 10, 2-3 PM ET) - The second session will focus on communications for a contaminant or water outage event from response through recovery. Topic areas will include dissemination, implementation, and recovery concerns, such as taste and odor.

Register for Part 2 (WaterISAC Pro Members only)

Please be advised that there is a separate registration for each session; you must register for each session you wish to attend.

If you are not a WaterISAC subscriber but would like to know how to subscribe, please contact Michael Arceneaux at the WaterISAC arceneaux@waterisac.org.

Version 6.0 of EPA’s Vulnerability Self-Assessment Tool Is Now Available

EPA has released a full version of the updated Vulnerability Self-Assessment Tool (VSAT) Version 6.0. It is available for download at www.VSATusers.org, and will replace VSAT 5.0 on EPA’s website in the near future.

VSAT 6.0 is compliant with the ANSI/AWWA J100-10 standard “Risk and Resilience Management of Water and Wastewater Systems” as issued January 2010. It also includes important new features that make the tool more user-friendly for small systems and new users, an enhanced natural disaster threat assessment process, and a revised risk assessment approach. For a detailed list of features, as well as online training on VSAT 6.0, see www.VSATusers.org.

Please contact Dan Schmelling at schmelling.dan@epa.gov with any questions or comments.

 

EPA Releases New Video: SECURE YOUR UTILITY

EPA recently released a new video that highlights the importance of developing a security culture at drinking water and wastewater utilities. The video describes how Pima County Regional Wastewater Reclamation Department implemented some of the Key Features of An Active and Effective Protective Program and how the utility benefited from its enhanced security.   Some of the novel security practices described in the video are developing a security scorecard program and hiring a law enforcement official.  The video is available at: http://youtu.be/X7Mg6-BwZEI .

Want to know more about the Key Features?  You can read about them at  http://water.epa.gov/infrastructure/watersecurity/features/index.cfm

EPA & ASDWA to Co-Host a COOP Webinar for Labs

PLEASE SAVE THE DATE!

On September 18, 2014, from 1:00- 2:00PM (eastern) ASDWA will join EPA WSD to present a webinar on the Water Laboratory Alliance’s Continuity of Operations Plan (COOP) Template for all drinking water and wastewater laboratories. COOPs are a valuable tool when preparing for events that may disrupt normal operations.  Please share this invitation with your state lab colleagues and other labs in your state who might benefit from this opportunity.  This might also be a good opportunity for you to consider just how well your own COOP stacks up!

Information on how to register will be sent out shortly.

The webinar will focus on the importance of having an active COOP and will explain how the existing template can be customized for individual state, private, and utility drinking water and wastewater laboratories. There will be time at the end of the webinar for a Q&A session.

Meanwhile, if you have questions about this event, please contact Nina Hwang at EPA WSD (Hwang.nina@epa.gov).

EPA, DHS and the Department of Labor Issue Joint Chemical Facility Safety Report

In August 2013, President Obama issued Executive Order 3650 Improving Chemical Facility Safety and Security to improve the safety and security of chemical facilities and reduce risks to facility workers and operators, communities, and responders.

 

The Tri-Chairs of the Chemical Facility Safety and Security Working Group (the Department of Homeland Security, the Department of Labor, and the Environmental Protection Agency) established by Executive Order 13650 submitted the status report to the President, Actions to Improve Chemical Facility Safety and Security – A Shared Commitment, which was publicly released today, June 6, 2014.

The report summarizes the Working Group’s progress, focusing on actions to date, findings and lessons learned, challenges, and short and long-term priority actions.  These priority actions are captured in a consolidated action plan, based on the information collected by the Working Group, and focus on specific five thematic areas:

  • Strengthen Community Planning and Preparedness
  • Enhance Federal Operational Coordination
  • Improve Data Management
  • Modernize Policies and Regulation
  • Incorporate Stakeholder Feedback and Develop Best Practices

You can download the report http://www.osha.gov/chemicalexecutiveorder/; view a fact sheet Chem EO Fact Sheet 6-6-2014;  and read a blog article http://social.dol.gov/blog/a-shared-commitment-improving-chemical-facility-safety-and-security/#more-12813 about the issuance of the report.

The water community should be particularly aware of the Report’s recommendation that the existing waiver for water and wastewater utilities be removed and that, in light of the West Virginia chemical spill, EPA has determined to work with states to “…encourage States to review and update existing source water assessments if necessary, including potential inclusion of information available through various chemical regulatory programs to determine whether adequate preventive measures are in place.”

Updates for WCIT and WHEAT Now Available

EPA’s Water Contaminant Information Tool (WCIT) has just added 11 contaminants to the online database.  The 11 new contaminants are:

  • Aluminum sulfate
  • Ammonium Hydroxide Chlorine Dioxide
  • Dioxins
  • Furans
  • Hydrogen Peroxide
  • Ozone
  • Sodium Hydroxide
  • Sodium Hypochlorite
  • Sodium Sulfite
  • Sodium Thiosulfate

This brings the total number of searchable contaminants in the WCIT database to 113.  WCIT also now includes a CBR Advisor, an interactive expert system that supports real-time responses to contamination incidents, as well as serving as an individual or group training tool.  “CBR” stands for chemical, biological and radiological contaminants.  For more information on WCIT, please visit the EPA Water Lab Alliance page at http://water.epa.gov/infrastructure/watersecurity/wla/index.cfm#factsheets

 

WHEAT, the Water Health and Economic Analysis Tool is now available in version 3.0.  WHEAT is designed to help drinking water utilities in quantifying human health and economic consequences using a variety of scenarios that pose a significant risk to the Water Sector.  WHEAT 3.0 supports consequence analyses for three scenarios:

  • Loss of one or more assets
  • Release of a stored hazardous gas, and
  • Intentional contamination of a drinking water distribution system.

Users must register with EPA to gain download access to the WHEAT tool.  For more information and to download the tool as well as a quick reference companion guide, please go to EPA’s Water Security Tech Tools web page at http://water.epa.gov/infrastructure/watersecurity/techtools/wheat.cfm

 

Natural Disasters and Private Wells – What to Do

Editor’s Note:  The edited information below was taken from the Summer 2014 edition of WellCare News, a publication of the Water Systems Council.  The article describes common sense “what to do” options for private well owners after a natural disaster – hurricane, flood, tornado etc. – may have compromised their well.  For the complete article, please visit http://www.watersystemscouncil.org/enews.php

Natural disasters and emergencies such as flood, fire, hurricanes, tornadoes, and wind storms affect thousands each year. If you are a private well owner, and a natural disaster has occurred on or near your property, there are some things you need to know about your drinking water supply.

Concerns and Advisories

If in doubt about your water supply, follow local or state health department drinking and bathing advisories.

Remember that there is danger of electrical shock from any electrical device that has been flooded; consult a certified electrician. Rubber boots and gloves are not adequate protection from electrical shock.

Septic systems should not be used immediately after floods. Drain fields will not work until underground water has receded. Septic lines may have been broken during flooding or other storms. Contact a local plumber or septic service immediately.

For information on long-term water quality conditions in the area or information on home water treatment devices contact your local or state health department or drinking water primacy agency, the wellcare® Hotline at 888-395-1033, or the Water Quality Association (WQA) at 630-505-0160 for assistance.

Conditions at the Well

Moving flood water or high winds can carry large debris that could loosen well hardware, dislodge well construction materials or distort casing. Coarse sediment in flood waters could erode pump components. If the well is not tightly capped, sediment, debris, and flood water could enter the well and contaminate it. Wells that are more than ten years old or less than 50 feet deep are likely to be contaminated, even if there is no apparent damage. Floods or heavy debris may cause some wells to collapse.

Electrical System and Pump Operation

After flood waters have receded and the pump and electrical system have dried, do not turn on the equipment until the wiring system has been checked by a qualified electrician, well or pump contractor. If the pump’s control box was submerged or damaged during flood or other storms, all electrical components must be dry before electrical service can be restored. Get assistance in turning the pump on from a well or pump contractor.

All pumps and their electrical components can be damaged by sediment and flood water. The pump, including valves and gears, will need to be cleaned of silt and sand. If pumps are not cleaned and properly lubricated they can burn out. Get assistance from a well or pump contractor who will be able to clean, repair or maintain different types of pumps.

Treatment Options for Safe Drinking Water

In most emergency situations, obtaining bottled water is the most commonly promoted way to access safe drinking water. However, there are treatment methods you can use when the quality of water is compromised during an emergency and it is not possible to obtain bottled water. But before considering such an approach, contact the local health authorities to assure yourself that the emergency has not introduced any chemical contaminants of concern into your well system. If the water only needs to be disinfected to be potable, there are 4 main options to treat water to make it safe for consumption:

  • Boiling
  • Chlorination
  • Distillation
  • Water treatment devices certified for microbial reduction of bacteria, cysts, and viruses

Do not rely on water treatment filters or devices that are NOT certified for microbial reduction as they may not provide the protection necessary for emergency situations. Consult a water professional or manufacturer for more information. (Visit http://www.WQA.org to learn more about the different kinds of home water treatment systems that are available.)

For any of the disinfection options listed above, begin by preparing a clean storage container. You will need a little treated water to do these steps, so keep in mind this can be done simultaneously while disinfecting water. Use food-grade storage containers when possible, or re-use plastic 2-liter soda containers.

1.  Wash the container thoroughly with dish soap and clean water first, especially when reusing soda or other containers.

2.  Disinfect by mixing 1 teaspoon unscented chlorine bleach to ¼ gallon of water and pour it into the storage container.

3.  Agitate the liquid by swishing the mixture around inside the container to ensure that it hits every surface.

4.  Rinse thoroughly with disinfected water.

Emergency Disinfection of Your Well

After the power has been restored, you will need to disinfect your well. Clear hazards away from wells before disinfecting. It is best to have your well disinfected by a well professional. During an emergency, it may not be possible to contact a well professional. In this case, refer to our wellcare® information sheet on “Disinfecting Your Well” for complete instructions. It is important to note that disinfection will not remove pesticides, heavy metals, and other types of non-biological contamination.

Do not drink or cook with the water until a water test is performed and confirms there are no harmful contaminants in your water.

Testing Your Well Water

You should have your well water tested after disinfecting your well to confirm bacteria is gone and other contaminants are not present. For more information on testing your water, refer to our wellcare® information sheet on “Well Water Testing.”

Contact your local or state health department or state primacy agency to have your water tested or to get a referral to a state certified laboratory that can perform water testing. If you need assistance, contact the wellcare® Hotline at 888-395-1033.