Toward Cybersecurity Evaluation by Design in Water Utilities

Abstract Information: Cybersecurity is a complex and transboundary phenomenon that occurs at multiple levels across organizations and sectors, impacts all actors in interconnected and often politicized ways, and involves an uncertain yet ongoing process of innovation and collaboration (Carr & Lesniewska, 2020; Kaufman et al., 2023). As water utilities are transforming into complex, constantly evolving cyber-physical-human systems (Bhandari et al, 2023), they have become an increasing target of malicious state and non-state cyber actors (Cybersecurity & Infrastructure Security Agency [CISA], 2021; Burgess & Tra, 2024). Lack of adequate cybersecurity evaluation hinders efficient technology deployment and process management that can help in cybersecurity readiness, response, and recovery (Leszczyna, 2021). Moreover, current cybersecurity evaluation approaches have not sufficiently connected the three pillars of cybersecurity namely – people, process, and technology (Leszczyna, 2021; Schon et al. n.d.). This study aims to fill this gap and develop a learning framework for implementing cybersecurity evaluation-by-design through a multimethod research approach. The realm of cybersecurity generally considers humans as problems, leading to efforts to exclude, control, train, and constrain them, thereby reducing them to rule followers (Zimmermann & Renaud, 2019). While this approach seems ‘technologically’ appropriate, it robs organizations of their human agents and workforce capacity to contribute to cybersecurity innovations and strategies. Understanding the interactions of the trio – people, process, and technology – through a careful evaluative process can provide insights into how employee agency and behavior affects cybersecurity efforts and how to mitigate related water utilities’ threats, risks, and vulnerabilities through developmental initiatives. There is a need to integrate evaluation-by-design into cybersecurity practices. This will help promote the transition from “a human-as-problem to a human-as-solution cybersecurity mindset” (Zimmermann & Renaud, 2019). The methodological approach adopted in this study builds on the security-by-design concept. Products that are secure-by-design use anticipatory security approach and prioritize customers’ or users’ security as ultimate business goals, being foremost considerations before product development starts and not bolted on later (Casola et al., 2020; CISA, 2023). As a concept, cybersecurity evaluation-by-design explores the incorporation of security-by-design principle with the evaluation logic in developing cybersecurity practices from the outset to nurture innovation, change, and learning in a complex adaptive environment. This study advances developmental evaluation based on evaluative thinking and futurist inquiry to support a culture of continuous and adaptive learning (Gamble, 2008; Patton, 2011, 2019), while exploring real-time feedback, changing threat environment, and technological advancement. Developmental evaluation as an evaluation niche for evaluative thinking in futurist inquiries offers opportunities for developing and working with “knowledge workers” – cyber innovators – to envision an uncertain cyber future in complex dynamic situations and facilitate ongoing learning, adaptation and “continuous futuring” (Patton, 2019).