Water SCADA Cyber Threat & Resilience Model

Attack Scenarios (CISA Vectors) Purdue L1–L3

Attack Injection Control

Real-Time Audit Log

[00:00:01] System telemetry online. Modbus port 502 listening.

[00:00:45] CRITICAL: Unauthorized remote setpoint override sent to PLC-02.

Free Chlorine Residual (Dosing)

8.40 PPM

EPA Safe Limit: 0.20 – 4.00 PPM

Distribution Main Pressure

118 PSI

Nominal Range: 45 – 75 PSI

Clearwell Tank Storage

94 % Fill

Normal Capacity: 30 – 85%

Treated Effluent Outflow

11.8 MGD

Rated Plant Capacity: 12.0 MGD

PHYSICAL PROCESS LEVEL 0 (Hydraulic & Chemical Treatment Stream) TOXIC OVERFEED IN PROGRESS

PURDUE ARCHITECTURE (Levels 1 to 4) — Click Nodes to Inspect Tap link or node to audit security

Node Inspector: Click any node above (Cellular Gateway, SCADA Server, Dosing PLC, Sensor) to inspect communication protocol, vulnerabilities, and hardware fail-safe status.

Defensive Hardening Controls Score: 28/100

Enforce OT Perimeter VPN & MFA Closes direct internet ports (Port 502/44818); requires hardware multi-factor token for remote access.

Mechanical Overfeed Limit Switch Physical hardware stroke-limiter on dosing pump physically capping chlorine injection at max 3.8 PPM.

Redundant Out-of-Band Sensor & Relay Secondary air-gapped residual analyzer with hardwired shunt trip relay that cuts pump power during drift.

Hydraulic Mechanical Burst Diaphragm Spring-loaded pressure relief bypass pipe routing excess distribution surge back to suction well at 80 PSI.

ICS Protocol Anomaly Monitoring (NDR) Passive SPAN-port analysis detecting unauthorized Modbus function code 16 (Preset Multiple Registers).

Incident Consequence Metrics

Time to Compromise: 45 sec

Peak Chlorine Dosing: 8.40 PPM

Hydraulic Overpressure Risk: Zone 2 Main Hazard

EPA/CISA Compliance Posture: NON-COMPLIANT

CISA / EPA Water Utility Cybersecurity Posture Report