Threat-Source Selection for a Regional Water Utility
Régie des Eaux du Sud supplies 380,000 customers through 120 pumping stations. Its SCADA runs on cellular modems and PLCs that are 15 years old; one OT engineer supports the estate and there is no SOC. In the last six months, 14 HR mailboxes were phished, a maintenance contractor's remote-access account was used from an unfamiliar ASN, and an activist group posted maps of pumping stations online to protest a tariff increase. The steering committee wants Workshop 2 to retain only 'cybercriminals and hacktivists' because 'a state would not target a water utility' and 'our staff are loyal.' The OT engineer warns that excluding insiders will make the risk picture unusable, but the committee wants a short list. The study has eight weeks and the regulator expects a report covering threat sources, motivations and capability. The team has no threat-intelligence subscription; it has incident tickets, the contractor register and open-source reports.
1. Assess the committee's proposed threat-source list. Which sources should be retained, and what reasoning should be documented for each?
Read the worked answer
The committee's list is too narrow because it confuses loyalty with control. Retain cybercriminals for extortion and disruption; the phishing tickets show access attempts and the cellular modems are exposed. Retain hacktivists because the pumping-station map posting is evidence of intent and targeting. Retain insiders and contractors because the unfamiliar-ASN use of a contractor account is exactly the kind of access that a 'loyal staff' assumption ignores; motivation may be negligence, coercion or malice. Retain state-sponsored or state-aligned actors as a monitored source, not as the dominant scenario: water is critical infrastructure, capability is high, and motivation could be disruption or prepositioning even without current evidence. Document motivation, capability, opportunity and evidence for each source, plus a confidence level. A short list is acceptable only if it is a reasoned short list; deleting insider and state sources would make later scenarios blind to the access paths already visible in the incident data.
2. How should the team handle the missing threat-intelligence subscription when assessing motivation and capability?
Read the worked answer
Replace purchased intelligence with structured local evidence and explicit confidence. Use incident tickets to establish what has actually been attempted; use the contractor register and remote-access logs to establish who can reach OT; use open-source reporting and sector CERT advisories for capability trends. Score motivation and capability qualitatively, such as low/medium/high, and record the evidence behind each score. Where evidence is absent, write an assumption and an owner for validating it, rather than inventing a precise likelihood. The OT engineer's knowledge of PLC models and cellular exposure is valid evidence for capability. This approach gives the regulator an auditable rationale and lets the team revisit scores if new incidents occur. It also prevents the common failure of treating 'no intelligence subscription' as 'no threat'.
3. What is the risk of treating 'state-sponsored' as irrelevant for a water utility? Explain using the notion of objective and capability.
Read the worked answer
A state actor's relevance is not limited to whether it wants to steal customer data. Its objective could be disruption of pumping, reconnaissance for contingency planning, or leverage through a supplier. Its capability is high and persistent, and the utility's exposure runs through cellular modems, remote contractors and legacy PLCs. If the team excludes the source entirely, it will miss long-duration, stealthy paths and supply-chain vectors that are not well represented by cybercriminal ransomware. The correct treatment is proportionality: if there is no current evidence, rate likelihood low but keep the source as a monitored scenario because impact could be high. That preserves the committee's desire for a short list without turning a plausible critical-infrastructure threat into an invisible one.