# Cyber-Physical Systems for Water Supply Network Management: Basics, Challenges, and Roadmap
## 5 CPS-WSS Monitoring Application Challenges and Future Directions
### Application Challenges
#### 5.1.7 Data Security and Privacy  
CPS sensing devices communicate via wireless communication technologies to enhance the system's flexibility, but due to the broadcast nature of wireless media, they pose more security risks [121; 122] and are susceptible to multiple cyber-physical attacks. A cyber-attack is the attack performed via malware or access to communication network components. A physical attack directly interferes with the CPS' physical components, such as attacking the sensing and control elements. For instance, a physical attack on a CPS may include a replay attack and alteration of control statements [123; 124]. Several cyber-attacks on CPSs have been reported in the literature [124; 125; 126]. Amongst others, these include eavesdropping, denial of service (DoS) attack, man-in-the-middle attack, jamming attack (aerial jamming and correlated jamming), resonance attack, false data injection (FDI), and packet modification. Eavesdropping is not a direct attack but can be considered as an intrusion or violation data privacy. An eavesdropping attack occurs when an intruder attempts to steal the water network data the CPS sensing devices transmitted over the wireless network [125]. This type of attack is hard to identify as it does not cause disruption to the network data transmissions. In an FDI attack, the attacker eventually infuses fake readings into smart water meters to interrupt the state estimation process of water supply systems [126]. A DoS attack [127] is the one in which the attacker sends large amounts of data to the network to make the network busy with data handling, and consequently, normal operational services cannot be achieved as the system operation is been disrupted. The man-in-the-middle attack is similar to the FDI attack. In this attack, fake messages are sent to the operator [128], resulting in the operator being able to make a choice that may not be needed, such as shutting down a section of water networks or closing a valve at the DMA inlet. The action of the operator could have triggered an undesirable incident by the time the operator follows the standard processes and tries to correct the issue. The jamming attack is considered a special case of DoS attack and is one of the serious security threats [129; 130; 131]. The attacker meddles with the normal functions of sensor nodes of the CPS by sending radio frequency signals to jam legitimate signals thereby causing a denial of service.  
Several cyber-attacks on the water supply system have been reported [132; 133; 134]. Typical examples of cyber-attacks on water system infrastructure include the insider threat to Australia's Moochy Water services [132] and the one that occurred on US water system facilities [138]. Water supply systems are critical infrastructure; therefore, security and privacy of the system data should be considered essential as the CPS not only handles an enormous amount of the sensitive water system data but also has the power to influence the water supply system facilities with its control capabilities. A successful attack on a cyber-physical water system could cause a various level of havoc to the water supply system. For example, significant damage, such as long operational downtime and disruption of service, economic loss to water utilities, and a threat to public health owing to water contamination, has been reported [18]. Therefore, addressing cyber security is essential because of the significant role of the cyber-physical water system on the national economy. Researchers have made progress in developing methodologies for cyber-physical attack detection [135; 136; 137; 138; 139; 140; 141; 142; 143; 144; 145; 146; 147; 148], however, they are not effective in preventing and resolving CPS security problems. Further research studies are therefore needed.