Protecting Rural Water Systems in the Digital Age

Elaine is a small town in Phillips County, Arkansas. One of the city’s most urgent challenges is its aging water infrastructure. Elaine Waterworks oversees a sprawling 34-mile system — the largest in Arkansas — with equipment dating back nearly 70 years. Parts of the system are so outdated that replacing key components, like pumps and panels, has become nearly impossible. The original well, unused but still standing, is more than a century old. 

In response, the city partnered with the Community Infrastructure Team at Communities Unlimited (CU) through a referral from the Arkansas Department of Health (ADH). With technical assistance from CU Community Environmental Management Specialist Deborah Brown, Elaine began applying for infrastructure upgrades — not just to modernize the physical system, but to defend it against 21st-century threats. 

Why Cybersecurity Matters for Water Utilities 

Water systems, especially in small towns, are increasingly vulnerable to cyberattacks that can disrupt service, compromise water quality, and erode public trust. The threat landscape for industrial control systems (ICS) is evolving, with advanced cyber threats now targeting rural systems more frequently as “soft targets.” Failing to update Operational Technology (OT) leaves communities in an undefendable posture. 

Elaine Waterworks decided to step up and encourage the city to apply for an estimated $302,563 from the Arkansas Natural Resources Commission (ANRC) to replace more than 600 water meters with radio-read models and install a Supervisory Control and Data Acquisition (SCADA) system. These upgrades will enable real-time, remote monitoring of water pressure, levels, and chlorine — essential for early detection and rapid response to system issues. 

“Until Communities Unlimited brought it up, I hadn’t even considered cybersecurity,” said Mayor Gilbert. “But with technology advancing and us being so far behind, it became clear that cybersecurity needs to be part of our system upgrade. We can’t afford to ignore it anymore.” 

Her realization followed a wake-up call in 2023, when a lightning strike damaged the system, leading to an unnoticed drop in water pressure and a subsequent boil order. With a SCADA system in place, that incident could have been identified and addressed much faster. 

Natural disasters like lightning strikes or floods don’t just disrupt service, they can expose weaknesses in utility operations and highlight the importance of having a disaster recovery and incident response plan. In fact, these events often become the catalyst that forces communities to modernize. The result: stronger, smarter, and better-protected infrastructure. 

Building a Cyber-Resilient System 

Elaine’s decision to design its new system with cybersecurity as a built-in feature — not an afterthought — represents best practice. It’s a forward-looking approach that helps preserve public trust, reduce service outages, and limit the costly fallout of a cyber incident. 

The city’s investment in resilience reflects a broader strategy to protect rural critical infrastructure. As threats become more sophisticated and opportunistic, rural systems without protections become more likely targets. Disaster recovery must include all types of incidents — not just natural disasters but cyberattacks and system failures as well. 

10 Steps to Strengthen Water Utility Cybersecurity: 

1. Strong Password Policies: Require complex, frequently updated passwords. 
2. Regular Software Updates: Patch vulnerabilities by updating all software. 
3. Network Segmentation: Isolate sensitive areas of the system to limit access. 
4. Firewalls & Intrusion Detection: Monitor network traffic for suspicious activity. 
5. Data Encryption: Protect data both at rest and in transit. 
6. Access Controls: Ensure employees only access what is necessary for their roles. 
7. Regular Security Training: Educate staff on cyber threats and phishing risks. 
8. Incident Response Plan: Prepare a clear action plan for cyber incidents and disaster recovery. 
9. Backup Data Regularly: Keep secure backups and test recovery processes. 
10. Monitor & Log Activities: Track and review system activity for unusual patterns. 

By incorporating these best practices, utilities like Elaine Waterworks can boost operational resilience and safeguard public health and safety. 

Elaine’s commitment to cybersecurity, paired with infrastructure upgrades, represents a model for other rural towns. It shows what’s possible when small-town leadership is matched with the right support. 

“This kind of technology could be a game-changer for us,” Mayor Gilbert said. 

Harold Fisher, a Service Technician with cybersecurity expertise at Communities Unlimited, contributed technical insight to support this article. 

This article was funded under RCAP’s USDA Technitrain 24 – 25 grant.