# Water-Tight IoT-Just Add Security
## 2 Background
### Digitalization of the Water Sector (DWC Example)
However, based on discussion with technology providers and water utilities, we have classified solutions in three subsets, based on their level of integration with the water utilities:  
**Standalone solutions:**: These are solutions which are not interacting with any sensors or utilities. They can be web or mobile applications, publicly available or requiring authentication. **Solution with \"external\" sensors:**: These are the solutions that are gathering data from sensors \"in the wild\", using some long-range wireless technology (mobile networks, LoRa or Sigfox for instance) or manually gathered using most likely shorter-range wireless protocols, such as Bluetooth (low energy). Solution with \"internal\" sensors: These are the solutions that are gathering data from sensors that are placed in the water utilities (but not necessarily connected to their systems). While none of the solutions are directly connected to the water utilities in DWC, there will still be interactions, especially by operators accessing the application in order to make decisions. As such, we identified two major risks for water utilities when integrating/using digital solutions:  
**Supply-chain attacks:**: As already mentioned, water utilities, being critical infrastructures, must comply with strict regulations. It is safe to assume that they undergo regular audits and are supposed to be a difficult target for attackers to find entry points. This is the case for many industries and companies. To counter this, attackers might identify actors evolving around the main target and attack these companies instead, to later on leverage the trust in these companies as a means to attack the real target. This is called a supply chain attack and has been used successfully by attackers in the past. The most damaging one in recent years is the SolarWinds Supply Chain Attack discovered in December 2020. The network management system used by hundreds of thousands of companies was shipped with a malware, successfully hitting many high-value targets such as the US Federal government [12]. In January 2021, for instance, vulnerabilities in the Microsoft Exchange server were used to compromise hundreds of thousands of servers all around the world, including the European Banking Authority and the Norwegian Parliament [13,14]. More recently, there have been several cases of malicious node packages being uploaded to npm (npm is a package manager for the JavaScript programming language) as an attempt to target companies such as Azure, Uber or Airbnb [15]. **Being led to take wrong operational decisions:**: Most of the digital solutions, while not interacting with the water utilities, provide crucial information to the operators of a water utility and are used as a decision support tool. The interoperable decision support system and real-time control algorithms for stormwater management for instance, can be used by operators to predict the best maintenance window, thus optimizing the process. If the information is erroneous, though, it can lead to a release of untreated water in the environment as a direct result of the wrong planning. Similarly, if the early warning system for bathing water quality reports an incorrect value, so that bathing is authorized despite the quality being below the threshold, this can have disastrous consequences (both from a public health perspective, but also from a public relations one). Digital solutions vary a lot when it comes to the technologies used and to the services they provide, but it is possible to derive a high-level diagram of their architecture. Figure 1 presents such a diagram for DWC's solutions. Most solutions are only composed of a subset of the components presented here. The main components include  
**Data sources:**: Digital solutions usually rely on external data, which are then analyzed and/or transformed to provide added value. These data can take various shapes: some solutions collect environmental data using IoT sensors deployed in the wild (water sources, sewer network, etc.