Deception Architecture for Water and Wastewater Operational Technology Environments

Abstract - Water and wastewater utilities rely on operational technology (OT), including SCADA, HMIs, PLCs, RTUs, pumps, lift stations, treatment processes, and remote telemetry. Cybersecurity guidance for the sector emphasizes asset inventory, incident response, reduced public exposure, credential security, backups, assessments, and awareness training. This paper proposes a nonintrusive deception architecture for OT in water and wastewater systems that maps decoys, honey credentials, false historian artifacts, and protocol lures to utility zones. The architecture is derived through design science and document analysis of public water-sector cybersecurity guidance, OT security standards, and recent deception literature. It emphasizes passive observation, staged deployment, utility approval, alert enrichment, and evidence retention. The contribution is a sector-specific reference model that helps utilities generate high-confidence indicators of reconnaissance, credential misuse, remote-access abuse, and lateral movement without introducing unsafe control actions into treatment or distribution processes.