Cybersecurity isn’t just an IT issue for water and wastewater utilities; it’s a public safety issue. When your community depends on you for clean, safe water, even a minor website vulnerability can open the door to serious risks. From customer data breaches to full-scale ransomware attacks, hackers are constantly looking for ways in. That’s why strengthening your website security isn’t optional; it’s a critical part of protecting both your operations and the people you serve.
Inclind works with public utilities like water and water treatment companies to help them develop user-friendly, highly secure websites. For each website, our goal is to utilize the latest technology and security best practices to reduce the risk of hacks and cyber attacks. To learn more about our website design, development, and support services for water and wastewater treatment organizations, reach out today to talk to our team.
Why Website Security Is Crucial for Water Utilities
Every website should implement security measures. For better or for worse, a lot of data passes through websites, and communities rely heavily on these same sites. People (and governments) with bad intentions may choose to exploit that data or otherwise attack a website, causing a significant amount of harm.
For water and wastewater utilities, cybersecurityis even more important. These organizations provide a crucial service. That makes them a prime target for cyber attacks such as ransomware, manipulating valve and flow operations, tampering with industrial control systems (ICS), and altering chemical treatment formulations.
Utilities should take special precautions when it comes to the systems that are used to operate their plants (such as ICS). However, they should also be careful when it comes to their own websites. Not only can hackers gain access to sensitive customer data through their website, but they could potentially access information that could be used to control the water company’s operations (if the website and ICS networks aren’t properly segmented). A cyberattack that takes a website down can also be costly to remedy.
There are several measures that should be taken for every water and wastewater website. These steps, like using services that can encrypt DNS traffic, are the best way to harden your website against potential attacks. If you aren’t sure where to get started when it comes to website security, our team can work with you to explore your options and implement the best solutions for your site.
Best Practices for Water and Wastewater Website Security
Website security is incredibly important for any organization. It is perhaps even more important for utility companies that may face attacks from both individuals as well as government actors. Below, we list some of the ways that you can make your water or wastewater website more secure. If you need help implementing these options, we can help with our comprehensive website support and maintenance service.
Use Role-Based Permissions
The administrative dashboard of a website allows employees and other authorized users (such as an outside website design and development company) to make edits to the website. Content management systems allow website administrators to set role-based permissions. You should use this feature to ensure that anyone who has access to the back-end of your website can only perform actions in line with their level of authorization.
For example, you might set an employee up with “read-only” permission so that they can view site analytics, posts, pages, plugins, and other back-end information, but not edit the site. This type of role-based access can prevent problems with the website (such as unauthorized edits). It can also help to increase security by ensuring that people only have the access that they need to your website. As a best practice, employees and contractors should be given the lowest level of access they need to perform their roles in accordance with the principle of least privilege.
Set Up 2-Factor Authentication
In the past, it wasn’t uncommon to access a website using just a password. Additional authentication has become standard as a way to prevent unauthorized access. It should absolutely be part of your water utility or wastewater website security, both for the back-end and the front-end of the website.
Authentication essentially asks a user to prove that they are who they claim to be. In an era where website passwords are easily compromised, this extra step is necessary to avoid the potential risk of a cyber attack. Ideally, your water or wastewater website should use two-factor authentication (2FA), which requires at least 2 separate forms of authentication. This is much more effective than just one form (such as entering a piece of information that only the user would know).
While 2FA can still be compromised, it is a much stronger way to protect your website. It should be implemented both for the administrative dashboard as well as any account access for the front-end of the website. This can help to make sure that the website itself and customer accounts are protected from hackers.
Encrypt Web Traffic with TLS/SSL
If your water utility website offers account access, then it should utilize HTTPS to encrypt web traffic. HTTPS uses Transport Layer Security (TLS) or Secure Sockets Layer (SSL) to allow a browser to verify the authenticity of a server that it is connecting with before encrypting the data to exchange information. This can ensure that any sensitive data (such as login credentials, credit card information, and contact information) isn’t compromised.
Ideally, your website should use a service that offers auto-managed SSL/TLS certificates. This will allow your website and any applications that you use to establish more secure connections. These protocols can also help to speed up load times and increase your search engine rankings.
Encrypt DNS Traffic over HTTPS or TLS
Website content resides at an IP address, rather than at the URL itself. Domain Name System (DNS) lookup is the process of converting a website address into an IP address. DNS records are essentially a phone book for the internet to determine what IP address is associated with a particular domain.
Because both DNS queries and responses are sent in plaintext, they can be read by others, creating both security and privacy issues. Fortunately, it is relatively simple to encrypt DNS traffic with a free DNS resolver. Many water treatment organizations will opt for deploying an internal resolver as opposed to a third-party tool. This step should always be taken to allow network administrators to monitor and block DNS queries and to provide users with more privacy.
Utilize DNS Security
As described above, the DNS system isn’t ideal for security. Because of the way that these systems were designed, DNS servers are vulnerable to several different types of attacks, including DoS (Denial of Service) and domain spoofing. Using DNS security can address these gaps in security and make a website more secure.
Some DNS resolvers integrate these security measures, such as by adding cryptographic signatures to DNS records for authentication purposes. When choosing a DNS resolver, look for options that offer this type of protection, plus botnet protection and content filtering.
Prevent DDoS Attacks
Distributed denial-of-service (DDoS) attacks occur when a large number of computers or devices attempt to access a website at the same time. These attacks are usually orchestrated by a single attacker. A DDoS can take a website or a network offline for an extended period of time, putting your water or wastewater website out of commission.
There are tools that can be used to reduce the risk of a DDoS attack. These include opting for an always-on DDoS defense that can absorb malicious traffic and provide protection for all types of DDoS attacks. Rate limiting can also be employed to cap the number of times that a person can repeat an action within a certain period of time, reducing the risk of a DDoS attack.
Hide the Origin IP Address
Your water utility’s website resources are hosted at an IP address, not on the actual domain. If cyberattackers find the origin IP of your website, they could send attacks or traffic directly to the servers. This creates a risk of a hack or attack on the website itself.
There are several steps that you can take to hide the origin IP, in addition to using a DNS resolver. This includes not hosting a mail service on the same server where the web resources are hosted, rotating the origin IP, and ensuring that the web server does not connect to arbitrary addresses provided by users.
Block Bots
“Bots” or robots can sometimes be used for good, such as search engine crawlers that gather necessary data. Other types of bots can disrupt a website. Excessive bot traffic can spread spam content, slow down websites for legitimate users, and even lead to stolen accounts or data.
Your website administrator can implement a bot management service to reduce or eliminate the threat of bots. These services should make sure to allow “good” bots to reach the website while preventing malicious traffic, using machine learning, fingerprinting, and behavioral analysis to properly identify bots. This service should also integrate with other web application security services.
Review Analytics and Security Logs
While there are many services that can assist with website security, you should still be tracking and analyzing web traffic and security logs for threat analysis. This data, such as DNS query traffic, threats in HTTP traffic, and attack variations, gives your website administrator insight into site vulnerabilities. This can allow your organization to harden its defenses and optimize performance.
Be Careful with Third-Party Scripts and Cookies
Much of what users see on your website requires the use of third-party code, such as JavaScript and cookies. This code can sometimes be vulnerable to attacks such as malware, cookie tampering, and data theft. This can cause security problems for both your website and users.
To limit the risk from third-party scripts and cookies, water and wastewater website administrators should use a service that can give them visibility into these bits of code. A serviceshould provide full visibility into first-party cookies being used by websites and automatically scan third-party scripts for risks and then manage those risks accordingly.
Implement a Web Application Firewall (WAF)
A WAF acts as a protective filter between your website and incoming traffic. It helps block malicious requests like SQL injection, cross-site scripting (XSS), and other common attacks before they reach your servers. Cloud-based WAF solutions (such as Cloudflare or AWS WAF) are especially effective for utilities without large in-house security teams.
Keep Themes & Plugins/Modules Patched and Updated
Many breaches occur because websites run on outdated software. Be sure to regularly update your content management system (CMS), plugins, server software, and third-party integrations. Establish a patching schedule or enable automatic updates to close vulnerabilities quickly.
Maintain Secure Backups and a Recovery Plan
Even with strong defenses, incidents can still happen. Automated, encrypted backups stored offsite ensure you can restore your website quickly if it’s compromised. Pair backups with a disaster recovery plan so your team knows exactly how to respond and restore services.
Use Strong Security Headers
HTTP security headers like HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy add additional layers of protection. These settings help prevent issues like clickjacking, MIME-type sniffing, and data leakage.
Set a Content Security Policy (CSP)
A CSP restricts which scripts, images, and other resources your site can load. This reduces the risk of cross-site scripting (XSS) and malicious code injection, particularly when using third-party scripts.
Perform Vulnerability Scans and Penetration Testing
Routine vulnerability scans and periodic penetration testing help identify weaknesses before attackers can exploit them. Even small utilities can benefit from affordable automated scanners, while larger utilities should consider third-party security assessments.
Build a Secure Water Utility Website with Inclind
When it comes to website security, the ultimate best practice is to work with a company that can build secure features directly into the site. At Inclind, our website development team works with utility companies to help them build smart, secure websites. We can also help companies with ongoing website support and maintenance to keep their sites secure.
Based in Delaware, Inclind helps organizations throughout the United States design, develop, and maintain websites. Our website services for water and wastewater companies include web development and design services, measurement and analytics, custom integrations, site redesigns, and technical SEO. Our team stays on top of the latest developments in website security to ensure that our clients get the most secure websites possible.
We're happy to talk if you’d like to learn more about our website design, development, and security options for water and wastewater facilities. You can fill out our online contact form, call us at 800-604-8139, or hit the live chat button to talk to one of our experts about your website.