Reconfiguring governance: How cyber security regulations are reconfiguring water governance

Abstract

Developments in improved monitoring, asset management, and resource efficiencies led to the water industry promising a step‐change in the design and operation of these facilities: the “blending” of traditional engineering equipment with digital technologies. These apparent benefits inevitably produce new challenges of regulating an emerging techno‐political landscape. One of the regulations is Europe's Network and Information Systems Security Directive, which aims to improve cyber security across critical infrastructure providers. This paper focuses on the implementation of Network and Information Systems in the context of the water sector in England. At the national and supranational levels, Network and Information Systems acts as a boundary object that gathers diverse communities of practice without the need to establish common goals. Further, in the process of transposing the Directive into the sectoral context, Network and Information Systems requires interpretation by expert communities. We show how translating the regulatory scope to the sectoral landscape involves prioritizing some water governance goals over others. As diverse expert communities converge in their collaboration practices, their priorities align or stand in tension with public interests. We argue that cyber security regulations have potential to reconfigure water governance by refocusing strategic priorities away from traditional concerns of environmental governance. We suggest ways to maintain diverse collaborations across engineering, computing, and water expertise that Network and Information Systems implementation remains aligned with the goals of water governance.

When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

“…As both IT and OT systems are gaining Internet connectivity and real-time analytics functionalities, they are 'blending' into a single entity. And so are the previously separate concerns for cyber security and safety (Michalec et al, 2021). In short, contemporary 'big data' practices of OT and IT professionals are reconfiguring what critical infrastructures are made of.…”

“…Understanding risk management in critical infrastructures is a multifaceted issue of both qualitative and quantitative nature (Shreeve et al 2020). Despite the rise of rule-based and probabilistic risk methodologies, for example, attack trees, attribute-based algorithms (Tatam et al, 2021), security risk is ‘incalculable’ since there are limits of what could be inferred from scientific data (Amoore, 2014: 424).…”

“…Previous risk studies embedded in the critical infrastructure context highlighted that risk assessments are collaborative processes, rather than a matter of following a formal methodology (Frey et al, 2019; Shreeve et al, 2020). In doing so, they challenge the trope of ‘security expertise’ being solely a technical and individual matter.…”

“…weaknesses in computer systems) are thought about most commonly, and assets (i.e. equipment, documents, employees) least often, leading to an over-reliance on vulnerabilities-centred threat assessments (Shreeve et al 2020). Moreover, risk thinking is ‘front-loaded,’ as practitioners tend to think about risk in the beginning of the decision-making process, rather than systematically throughout the lifecycle of OT systems (Shreeve et al, 2020).…”

“…equipment, documents, employees) least often, leading to an over-reliance on vulnerabilities-centred threat assessments (Shreeve et al 2020). Moreover, risk thinking is ‘front-loaded,’ as practitioners tend to think about risk in the beginning of the decision-making process, rather than systematically throughout the lifecycle of OT systems (Shreeve et al, 2020). Meanwhile, as threats in cybersecurity evolve over time, risk management ought to be iterative and regularly updated (Ani et al, 2016; Frey et al, 2019).…”