Jason Lee and Steven Roberts, risk mitigation and security experts, postulate that the simple Trojan horse hack can result in cyberterrorism. Is this credible or simple fear mongering? CIO went to the Massachusetts Water Resource Authority (MWRA)?s operations center in Chelsea, Mass., to find out.

What we found was a system that would be difficult to hack into and any number of best practices for securing systems against cyberterrorism. Here?s the skinny:First, a hacker would need access to the MWRA computers. We are in a locked room accessible by key card and manned 24/7. To get in, you must check in at the facility?s front desk (and then check out later), offer your credentials, wear a temporary badge and be with an escort at all times. After you leave, your host will send a memo to senior management detailing the visit for the record.

The computers we?re looking at distribute water throughout much of eastern Massachusetts. An hour or so west?near the Wachusett Reservoir?is an identical crescent of computers that monitor water quality and control the chemicals that enter the water, according to Marcus Kempe, director of operations support at the MWRA.

Together, these two banks form the MWRA?s Scada system. Scada (pronounced ?scay-da?) stands for supervisory control and data acquisition; most public utilities rely on a highly customized Scada system. No two are the same, so hacking them requires specific knowledge?in this case, knowledge of the MWRA?s design and access to that customized software.

Scada is not networked, except in two places. One, a dial-up modem, is offline. Only one person has clearance to use it. Turning it on must be done manually by someone with clearance at the facility. And two, there is a link to the MWRA?s general IT infrastructure through a program called Plant Information (PI). PI gives a small set of supervisors with the highest clearance a one-way view of data about the water system. They can look, but they can?t touch. This data can also be piped into a war room around the corner from us in the operations center, which is used for incident response.