Skip navigation
Top-down view of two workers in safety vests and helmets standing on a concrete dock next to a body of water, casting long shadows in the sunlight.
Feature

Five lessons for protecting critical infrastructure in times of crisis

Start reading
Feature

Five lessons for protecting critical infrastructure in times of crisis

How can we ensure that essential services like water, wastewater and electricity continue to function during crises or conflict? Globally, critical infrastructure faces growing threats from climate impacts, cybersecurity breaches, socio-economic shifts and armed conflict. Yet there are steps we can take to mitigate these risks – here are five lessons to bolster infrastructure resilience.

Maria Sköld, Karina Barquet / Published on 4 December 2024

2024 has been a dramatic year for water security in many parts of the world. Headlines speak of destroyed water infrastructure in Gaza, Ukraine and other areas impacted by conflict. Flooding has become so severe that both water and wastewater systems are frequently overwhelmed. American authorities warn that cyberattacks against US water utilities have reached record highs. In Sweden, water utilities have been asked to ramp up security measures after a wave of suspicious break-ins that may be linked to espionage.

It is clear that water and energy sectors need to rethink many aspects of security around critical infrastructure.

“We need a new mindset, with crisis preparedness front and centre,” said Karina Barquet, SEI Senior Research Fellow. “There are good initiatives in different parts of the world, and these must be shared. We want to raise awareness of the new risks and encourage water utilities, wastewater plants and other service providers to ramp up the protection of their operations.”

Earlier this year, Barquet moderated a workshop at World Water Week aimed at raising awareness of emerging threats and how they can be addressed. The workshop, organized by SEI in collaboration with IWA Sweden, IVL, Luleå Technical University, RISE, Swedish Water Association and Sweden Water Research, brought together experts and participants from around the globe to share strategies for safeguarding critical services.

The discussion was shaped by four key themes: climate change, cyber security, armed conflict and major socio-economic shifts. Here are the lessons and actionable insights that emerged:

Lesson one: the climate crisis brings constant uncertainty

As global temperatures increase, the water cycle is disrupted, with dramatic consequences such as sea-level rise, flooding, melting glaciers, altered river flows and prolonged droughts. Countries face unprecedented levels of uncertainty, with significant effects on economies, food production and lives.

“Our societies are not built for such extremes and constant uncertainties,” noted Ashok Swain, Professor at Uppsala University’s Department of Peace and Conflict Research, as he introduced the topic.

Many participants noted similar experiences from their home countries. Water cuts are becoming more frequent due to longer dry spells; water contamination is rising as flash floods overwhelm infrastructure; and power shortages are increasingly forcing water treatment plants to shut down.

Actions to address climate uncertainty:

  • Conduct continuous risk assessments and monitoring through advanced planning and scenario analysis.
  • Establish climate-resilient standards for infrastructure, supported by stricter regulations, grants or tax breaks.
  • Increase redundancy and diversification, for example by drawing drinking water from multiple sources.
  • Build capacity through global and community-level collaboration.
  • Utilize innovation and technology, including grid technologies for smart water management, green infrastructure and nature-based solutions.
  • Improved financial planning and investment, with resources made available for low-income countries.

Lesson two: armed conflicts pose new threats for civilians

Civilians endure unspeakable horrors during armed conflicts, and many lose access to clean water and electricity. Some workshop participants shared experiences from countries or regions where they have lived and worked, such as Nigeria and Syria. Water plants and wastewater treatment services are often attacked or occupied in breach of international law, and dams have been weaponized, despite their special protection status.

However, participants also highlighted positive examples, such as France incorporating emergency preparedness plans into its national water policies.

Debora Falk, Specialist in Contingency Planning for Water and Sanitation at Norconsult, brought valuable insights from her work in conflict zones such as Israel/Palestine and eastern Ukraine. She emphasized the importance of planning to enhance the protection of civilians, noting how civilians can unintentionally come in harm’s way due to the lack of separation between military and civilian objects. Falk explained that water infrastructure is often located in areas of strategic importance during conflict, such as near rivers, hills or access points needed by armed forces.

This overlap of military and civilian needs, combined with the rise of new technologies that serve both sectors, increases the risks to civilian safety during armed conflicts. Falk stressed the urgent need for better planning and greater awareness among decision-makers to mitigate these risks before a crisis occurs.

Actions to protect civilians during armed conflicts:

  • Incorporate emergency preparedness plans into national water and sanitation policies.
  • Strengthen the enforcement of international laws that protect water systems in conflicts.
  • Address risks posed by the overlap between military and civilian use of water infrastructure.

Lesson three: cyberattacks can create cascading risks

Heather Harrison Dinniss, Senior Lecturer at the Swedish Defence University, described the growing threat to critical infrastructure from cyber operations, which can cause human suffering and costly downtime. Attacks can come from state actors and their proxies, cybercriminals or even a disgruntled former employee. Current staff can also pose security risks, whether through intentional acts like espionage or inadvertent actions that give attackers access to company systems.

Workshop participants flagged two major risks: a lack of cybersecurity awareness in the water sector and the complex cascading impacts of cyber incidents. The latter arises from the high interdependence between systems such as electricity, energy production and water, which can blur accountability for managing these risks. Emergencies like flooding can further exacerbate cascading effects, as demonstrated in countries like Brazil, China and Colombia. Participants emphasized the need for greater resilience thinking across different levels and advocated for the development of manual back-up plans.

Harrison Dinniss’s five-point list of immediate actions for organizations:

  1. Conduct cybersecurity checks of systems to find (and fix) vulnerabilities.
  2. Practice basic cyber hygiene and ensure all staff do too.
    1. Update and patch all software and firmware, particularly antivirus software.
    2. Ensure ALL default passwords have been changed.
    3. Use multifactor authentication on critical systems.
    4. Educate staff on phishing emails and social engineering techniques.
  3. Limit unnecessary contact with the open internet. If remote access is not necessary, remove it. Monitor all remote access points like VPNs and keep access permissions up to date.
  4. A cyber security incident response plan must be in place.
  5. Security-by-design should be required whenever new systems are installed or old systems are updated.

Lesson four: socio-economic trends affect everything

Compared to the other three risks, socio-economic trends may receive less attention, but they have significant impacts on water infrastructure. Urbanization, demographic changes, migration patterns, economic growth, and emerging technologies like AI can sharply increase water demand. Environmental degradation and how water is valued also play critical roles in influencing how systems function.

Diego J. Rodriguez, Lead Water Economist for Eastern and Southern Africa at the World Bank, explained how socio-economic trends are factored into his analyses of climate change, resilience and urban water security.  “We cannot predict the future,” he noted, “but we can identify both the pressures that make our critical infrastructure vulnerable, and the interventions required to ensure adaptable and resilient systems”.

One notable example is agriculture, which is currently the largest global user of freshwater. Future water demand, however, will be shaped not just by population growth but also by changing food preferences, economic growth, trends and technological advancements. Another example is mining – a water-intensive and often polluting activity – where shifts in demand for specific minerals driven by new technologies can quickly alter water usage patterns.

Many workshop participants shared how socio-economic shifts have had major repercussions in their countries. Mega cities are expanding rapidly, particularly in areas with informal settlements that lack centralized water and sewage systems. Other regions face challenges such as aging infrastructure, underinvestment and economic instability, often compounded by weak financial systems.

Actions highlighted during the workshop included:

  • Earmarking funds specifically for infrastructure maintenance to ensure system longevity.
  • Promoting public-private partnerships to address investment gaps.
  • Encouraging cost-sharing initiatives across borders to enhance regional water cooperation.

Lesson five: new needs for collaboration and specialization

Summarizing the workshop, many participants emphasized the connections between the different risks. The four themes – climate change, armed conflict, cyber threats and socio-economic trends – are all marked by high levels of uncertainty and the potential for unexpected cascading risks. As such, these risks must be analysed and addressed jointly.

At the same time, the complexity of these challenges requires deep specialized knowledge and enhanced capacities to respond effectively.

Workshop participants highlighted key skills for strengthening the resilience of critical infrastructure, including:

  • The ability to rapidly gather new information.
  • Ensuring the right competence in managing agencies.
  • Assessing changing situations quickly and accurately.
  • Engaging effectively with actors outside traditional networks.

Design and development by Soapbox.