Chapter 6 — Security and Risks

6.1 Risk Category Overview

Surface water monitoring systems face risks across five distinct domains. Physical risks arise from the harsh outdoor environment and the accessibility of remote sites to unauthorized personnel. Cybersecurity risks stem from the use of public cellular networks and internet-connected cloud platforms. Data integrity risks include sensor drift, biofouling, and transmission errors that can corrupt the measurement record. Environmental hazards such as floods, lightning, and extreme temperatures can damage hardware and interrupt service. Operational continuity risks include power failures, communications outages, and maintenance gaps that cause data gaps in the regulatory record.

6.2 Cybersecurity Architecture

The cybersecurity architecture for a surface water monitoring system must address threats at each layer of the system: field device firmware, edge gateway configuration, communications channel, and cloud platform access control. The following security controls are mandatory for all deployments that transmit data over public networks or connect to regulatory reporting systems.

• All communications between the edge gateway and the cloud platform must use an encrypted VPN tunnel (OpenVPN or IPsec IKEv2) with TLS 1.3 for the application layer.
• Role-based access control (RBAC) must be implemented on the cloud platform, with separate roles for field technician, data analyst, system administrator, and regulatory viewer.
• All RTU and gateway firmware must be signed by the manufacturer and verified before installation. OTA firmware updates must use a secure update channel with signature verification and rollback capability.
• Default passwords on all devices must be changed before deployment. Password complexity requirements must meet a minimum of 12 characters with mixed case, numbers, and special characters.
• All remote access sessions must be logged with timestamp, user identity, and actions performed. Logs must be retained for a minimum of 12 months and protected against tampering.

6.3 Lightning and Surge Protection

Lightning is the most common cause of catastrophic hardware failure in outdoor monitoring stations. A comprehensive surge protection strategy must address all conductive paths into the station enclosure: AC power, DC power, RS485 signal cables, Ethernet cables, and antenna coaxial cables. The protection strategy is based on IEC 62305 and IEC 61643.

6.4 Data Integrity and QA/QC Framework

Data integrity is the most operationally significant risk for regulatory monitoring systems, because corrupted or missing data can invalidate compliance reports and trigger enforcement actions. The QA/QC framework implements automated checks at the edge gateway and at the central platform to detect and flag suspect data before it enters the regulatory reporting stream.