Water operations: Cyber-physical risk assessment & management

In our connected world, there are constant attempts to attack computers for a variety of reasons, such as financial gain, political agendas, espionage, but also for the thrill and challenge. Although we usually hear about cyberattacks aiming to compromise computer systems or networks, often with the goal of stealing, altering or destroying data, or disrupting services, there is a type of cyberattack, the “cyber-physical attack”, which can affect both digital and physical systems and can be equally as threatening and harmful -if not more.

Cyber-physical systems are systems composed of computational and physical components that interact with each other and the real world. Examples include smart grids, automobiles, medical devices, and Industrial Control Systems (ICS). Cyber-physical risk refers to the vulnerabilities and threats that arise from the interaction between cyber (digital) and physical systems, potentially leading to physical harm, operational disruptions, environmental damage, financial losses, or compromised data.

With that in mind, it becomes obvious that a cyber-physical attack to Critical National Infrastructure, which encompasses the critical assets, facilities, systems and networks that are essential for a nation’s functioning, including its economy, security and public health, can have a significant effect on the population.

The infographic below shows the stages a threat actor must follow to attack a node and cause harm to the intended target (which are common to both biological and computer viruses). Therefore, understanding these stages, and identifying and analysing the exposure to cyber-physical attacks across an organisation, is key for an enduring cyber-physical risk management process.

To tackle this issue, the Mitre Corporation released in 2013 the Adversarial Tactics, Techniques and Common Knowledge, commonly known as MITRE ATT&CK, which is a globally accessible knowledge base for classifying and describing cyberattacks and intrusions. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cyber security product and service community, and it is open and available to any person or organisation for use at no charge.

By making cyber‑physical risk visible through GIS, we can bring the threat landscape together in one place – turning regulatory requirements into a practical, repeatable risk management process and enabling water operators to understand and act on their most critical vulnerabilities before they become real‑world incidents.

Panos Chiotis, Principal GIS Consultant

Our solution

In a nutshell, the solution Sweco designed and implemented is called Cyber-physical Risk Assessment Tool for SPEAR (in short “CRAT for SPEAR”), and it is an innovative, GIS-based tool which:

1. Identifies five risk outcomes, comprising Service, People, Environment, Asset, and Reputation (SPEAR)
2. Integrates data from the company’s asset management systems, and cyber-physical risk logs developed by Sweco, based on the MITRE ATT&CK approach, into a central ArcGIS geodatabase
3. Runs the CRAT for SPEAR Model within ArcGIS Pro, a bespoke analysis model to calculate the required cyber-physical risks and KPIs per site
4. Maps and visualises the calculated cyber-physical risks and KPIs per site across the company’s entire estate and identifies critical and high-risk sites where action is required, through the CRAT for SPEAR Dashboard, an interactive ArcGIS Dashboard on ArcGIS Online.

The CRAT for SPEAR Model, which is the backbone of the solution, was developed based on existing information from the company’s asset management systems, including:

1. Sites and Installations (SI)
2. Industrial Control and Automation (ICA) Equipment Assets
3. Regional Telemetry Systems (RTS)
4. Register of Sites where a Third-party Conduit has been installed

…and a methodology, designed by Sweco, which considers multiple factors, such as:

As part of the methodology, the risk is calculated as the combination of Likelihood (from 1 to 5) of cyber-physical attack, and Impact (from E to A) to Service, People, Environment, Asset and Reputation, using the matrix of twenty-five Risk values. The result is a series of fifteen cyber-physical risk logs (tables) per Threat scenario and DMZ type for each Cyber-physical Risk (Risk 1, 2 and 3) and risk outcome (SPEAR).

Next, the CRAT for SPEAR Model is calculating a zone complexity word (<RTU, Slave, PLC, LOI, SCADA>) and a conduit complexity word (<WAN, TEL, 3rd Party>) per site, based on technological characteristics of the associated assets. Also, the Model is assigning a DMZ type to each site, based on a logic that maps the site’s type and criticality to the DMZ types.

After that, the CRAT for SPEAR Model is calculating Risks 1, 2 and 3 for the five impact categories within the scope of SPEAR for each site by assuming the worst-case threat scenario in terms of risks (i.e. highest risk), and then it is identifying the highest probable risk from any one of the five impact categories for Risk 3 as “Risk 3 Maximum”.

Finally, the Model is transforming the sites dataset from a flat table (i.e. records without geometry) to an ArcGIS file geodatabase point feature class, projected in the British National Grid (EPSG:27700) and symbolised based on the calculated Risk 3 Maximum scores and the colour code system (green, yellow, amber and red) used for the twenty-five risk values ranked from low to critical by cost of financial risk per annum.

Outcome & benefits

The Sweco ArcGIS solution unlocked previously unexplored insights for the Client, including Risks 1, 2 and 3 for the five impact categories within the scope of SPEAR, across the whole site network. It also revealed weaknesses in the Client’s asset data inventories, which are currently being reviewed and updated.

Sweco provided an innovative, ArcGIS-based solution which:

1. Offers a portfolio of automated GIS workflows for re-running the cyber-physical risk assessment model and updating the online spatial content, ensuring accuracy of the outputs and improving efficiencies
2. Maps and visualises location-based analytics through a dynamic ArcGIS Dashboard, providing a data-driven view of the sites and ICS information and key insights for an at-a-glance decision-making
3. Enabled the Client to compare the level of risk across the site network, and proactively identify critical or high-risk sites to prioritise mitigation measures
4. Successfully leveraged the ArcGIS technology the Client has access to, by creating a comprehensive technical solution that improves their return on investment and adds value to their asset data inventories.

Future vision and further development

Sweco’s Client has incorporated CRAT for SPEAR into their monthly cyber-physical risk assessments to identify sites where action is required.

For Asset Management Period 8 (which is spanning from April 2025 to March 2030), the Client is considering two further developments for enhancing the risk assessment process:

1. As threats and vulnerabilities are identified by the National Cyber Security Centre (in the UK), alarms and warnings need to be raised automatically through a new vulnerability mapping capability, so that proper actions can be taken
2. The capability for a holistic view of the assets and connected machines’ situational awareness and state, by integrating real-time data streams with location intelligence.