A CISO who spends most of his time behind a laptop? Not at Hoogheemraadschap De Stichtse Rijnlanden (HDSR). At this water authority, Keith Farzan heads into the field to observe his colleagues at work and to see how digital risks affect their day-to-day tasks. For him, digital resilience is about far more than technology.
“Changing an organisation’s culture is the bigger challenge, and ultimately the one that determines its resilience. To make and sustain a genuinely safer organisation, awareness is key. That means paying close attention to behaviour, culture and attitude, and understanding what employees need in their day-to-day work to work safely.”
Keith Farzan has nearly 20 years’ IT experience. He began his career as a technical consultant, then moved into information security and privacy, advising organisations on security and standards. He now serves as HDSR’s Chief Information Security Officer (CISO), overseeing information security.
The CISO heads into the field
In that role, Farzan consults with IT staff and policymakers in the office and also spends time in the field. A significant proportion of HDSR’s roughly 950 employees regularly work outside the office. Instead of sitting at a laptop all day, they inspect waterways, manage installations, and interact with residents. “I go out into the field with colleagues. I really try to understand what they encounter and what their work involves.”
These visits take him to places such as sewage treatment plants. There, it quickly becomes clear why information security and process automation matter more to a water authority than merely protecting computers and data. “Digital systems also control physical processes that must keep functioning every day.”
This became especially clear during a visit to a large sewage treatment plant (RWZI) in Utrecht. “RWZI Utrecht treats around 65 million litres of wastewater from households and businesses in the city. You really feel that social responsibility. And you only feel that impact when you are standing there, not during an online meeting with people from the treatment plant.”
Practice does not follow a script
So what should a CISO primarily prepare for? Farzan turns the usual question around. “The question is not whether you will experience a cyber incident, but how well prepared you are when it happens.” HDSR therefore seeks to understand its risks as thoroughly as possible before anyone else discovers them. To that end, the water authority maintains a security team and undergoes regular audits.
HDSR also uses the shared facilities of the water authorities, including the Security Operations Centre (SOC). “When a high-urgency alert comes in, specialists first assess the situation. Is it a false alarm, or is something actually happening? If so, an investigation follows, and the team escalates as necessary.”
Fortunately, Farzan hasn’t had to experience this often, but it has happened enough for him to know that practice doesn’t always go as planned. “It does not always go as we had planned. Sometimes you have to experience something to truly understand it.” That’s why, after every incident or exercise, the question is always what could be improved. “Never waste a good crisis,” says Farzan. This isn’t a way of downplaying an incident; rather, such situations reveal whether agreements and processes work in practice.
Keeping measures ‘under the surface’
According to Farzan, being prepared also means ensuring that all employees understand their roles. This is a particular challenge for a water authority: office-based employees work differently from colleagues who conduct outdoor inspections or manage installations. “Those colleagues also use applications and, for example, have contact with residents. How do you ensure that safe digital behaviour fits into their work routines?”
Farzan wants to ensure information security doesn’t feel like a hindrance to employees. “As much as possible,” he says, “security measures should remain ‘under the surface’. Employees should not constantly notice the technical security taking place in the background. What should be visible, however, is the desired behaviour. HDSR deliberately avoids focusing only on departments or employees whose awareness has yet to meet the required standard. Colleagues who set a good example can be especially effective in bringing others along. A good example is worth following. It works far better when colleagues keep each other on their toes than when the security officer walks through the organisation like some kind of police officer.”
No need to reinvent the wheel 21 times
This learning approach is also important for water authorities. “No water authority can solve today’s challenges on its own,” says Farzan. “Cybercriminals work together, so it only makes sense for us to do the same.”
That cooperation does not mean every water authority is equally advanced in every area. According to Farzan, some excel in risk management and governance, while others lead in operational technology security. HDSR, meanwhile, has extensive experience in awareness, behaviour and culture. He believes this is exactly where cooperation is strongest. “There are 21 of us water authorities. We do not need to reinvent the wheel 21 times over.” That requires transparency. “Water authorities should not only share success stories, but also share mistakes, vulnerabilities and things that have gone wrong.”
Steering digital resilience
Meanwhile, digital resilience is increasingly a boardroom issue. For Farzan, this also means his role as CISO is changing. Board members do not need to become security specialists. “I see it as my responsibility to help board members make the right trade-offs and map risks properly.”
Responsibility also extends beyond the water authority. HDSR relies on suppliers and cloud services, and Farzan sees managing risks across that chain as one of the biggest challenges in the coming years. That is why the water authority is paying closer attention to supplier risks, for example through procurement requirements, agreements and security discussions. In his view, simply imposing requirements is not enough. “The pitfall is that we start pointing fingers and saying: you must do this and you must do that. I believe we should actually help each other and be transparent about the risks.”
Quick recovery
What should all this ultimately lead to? Not a water authority that has eliminated every digital risk; Farzan says that’s unrealistic. “What I do want is an organisation that knows its risks, cooperates within the sector, is well prepared for cyber incidents, and can recover quickly.”
With that, he returns to the common thread running through his work. Technology is necessary but not decisive. “The biggest challenge is not technical. We can solve the technical issues. The harder task lies with people and organisations: working together, making it easier to discuss risks, learning from experience, and making safe behaviour part of everyday work, whether behind a desk, during a dyke inspection, or at a sewage treatment plant. Ultimately, digital resilience comes down to how an organisation operates day to day.”
