A Water Tower in the Basement: A Cyber Range for Small Water Utilities

The question

Porter County and its three neighboring counties have 14 public water systems serving fewer than 3,300 people each. Most have one or two licensed operators who also read meters, fix hydrants and plow the village hall lot. Their pumps and chlorine feed are run by small programmable controllers and a screen in the pump house, and many can be reached remotely so the operator does not have to drive in at 2 a.m.

Dr. Nadia Molnar, professor of cybersecurity and information technology, studies industrial control system security. Her question was practical: what would it take for an operator in a three-person utility to notice that someone else was changing the setpoints, and to know what to do next?

The approach

The answer started with a model. In a basement lab in Jarvis Technology Center, students built a scaled, working water system: a 300-gallon clear storage tank standing in for the water tower, two pumps, a dyed-water stand-in for chlorine dosing, level and flow sensors, two industrial controllers, an operator screen and a remote-access modem configured the way small utilities commonly configure them. It sits on its own isolated network and connects to nothing outside the room.

The range is used three ways:

• Operator workshops. One-day sessions for utility staff: a tabletop exercise in the morning, then hands-on scenarios on the range in which students quietly alter tank levels, pump schedules or dosing.
• Assessments. Supervised student teams visit participating utilities to inventory equipment and remote access, always under a signed engagement letter with a named contact, and never touching a live system without one.
• Coursework. Scenarios are reused in CYBR 3700 Security Operations and in capstone projects.

The project is run through the Institute for Applied Cybersecurity, alongside the student Cybersecurity Clinic.

Students on the team

• Riley Kasprzak, senior, cybersecurity — range architect; wrote most of the scenario scripts.
• Thanh Pham, senior, cybersecurity — leads assessment visits and writes the plain-language reports.
• Grace Lindvall, junior, electrical engineering — wired the controllers, sensors and pump panel.
• Mateo Ruiz, junior, information technology — network isolation and logging.
• Hannah Zieglar, sophomore, cybersecurity — workshop logistics and the operator survey.

Before any student goes on an assessment visit, they shadow two workshops and sit through a half-day session with a licensed water operator, who explains what the pumps, valves and chlorine feed are actually for. Molnar considers that the most important part of the training. A student who does not understand why a tank level matters cannot judge whether a strange reading is an attack, a failing sensor, or a farmer filling a sprayer from a hydrant at dawn. Reports are reviewed by Molnar line by line and delivered in person, never by email alone.

What they found so far

Eleven utilities have taken part in an assessment and a workshop since January 2026. Aggregated, with no utility identified:

• Nine used remote-access software with a single shared password, and in five of those the password was also written on the pump-house wall.
• Seven had no offline backup of their controller programs; if a controller were wiped, nobody knew exactly how it had been set up.
• Most operators noticed a manipulated tank level on the range eventually. The median time was 41 minutes, almost always because the numbers on the screen disagreed with what the operator expected from experience, not because of an alarm.
• After a workshop, every participating utility made at least one change within 60 days; the most common were unique remote-access accounts and a printed backup of controller settings kept off site.

“The operators are good. They know their system by feel. What they did not have was permission to trust that feeling and a phone number to call when the numbers looked wrong.”

— Dr. Nadia Molnar, professor of cybersecurity and information technology

What’s next and who’s involved

This year the team is adding a wastewater lift station to the range, building a portable version that fits in a van for utilities that cannot spare an operator for a day in Porter Falls, and drafting a one-page incident checklist with the county emergency management office. The waiting list has six more utilities on it.

Partners: the Porter Falls Water Utility, which helped design the range and sends staff to test new scenarios, and the eleven participating village and town systems. Funding is a two-year, $640,000 award from the Wesconsin Office of Utility Resilience. Students usually join after CYBR 2200 Networking for Security.