Partnership to Protect Water Utilities from Cyber Threats
A national water association is creating a program designed to provide threat intelligence and cybersecurity services to underfunded water and wastewater systems across the U.S. The National Rural Water Association (NRWA) has launched a partnership with DEF CON Franklin, an organization that pairs volunteer cybersecurity experts with cash-strapped water systems in need of their expertise.
The Water Watch Center
The Water Watch Center (WWC) will provide direct support to smaller water utilities to mitigate attacks, including the recent string of incidents that have impacted water systems in at least 12 states. The program will see five managed detection and response providers work with DEF CON Franklin and the NRWA to offer cyber services for water utilities serving fewer than 10,000 people.
There are over 50,000 community water systems across the U.S. and 91% of them serve fewer than 10,000 people. The WWC has already started work in Maryland to identify rural water utilities in need of assistance, particularly those supporting military facilities.
Scaling Cybersecurity Services
DEF CON Franklin emerged two years ago among veterans of the popular security conference. It recruited 450 volunteer cyber experts, pairing many of them with water and wastewater utilities in Arizona, Indiana, Oregon, Utah, Vermont, Washington, and Wyoming. The effort was successful but exposed the difficulty of scaling cybersecurity services to the country’s 150,000 water and wastewater utilities.
The WWC has partnered with five managed detection and response providers, including Rapid7, Defendify, Legato Security, L1 Secure, and Sentinel Technologies. These companies will share threat information and data on vulnerability patches with the NRWA, which will operate as a hub.
Recent Cyberattacks on Water Utilities
The program emerged days after water utilities in Minnesota, Michigan, Georgia, South Dakota, and several other states reported cyberattacks on their operational technology, as the scope of a campaign allegedly linked to Iranian hackers continues to grow. On Friday, water utilities in two New Jersey towns came forward to say they had also been hacked as part of the campaign.
“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” said Jake Braun, the co-founder of DEF CON Franklin and former cyber official in the Biden administration. “Our incredible Franklin volunteers will support the effort to keep costs down for cash-strapped utilities fending off adversaries like the Iranian Red Guard or Chinese Military.”
Creating Digital Replicas of Water and Wastewater Systems
Officials behind the WWC said they are also working with Vanderbilt University and the U.S. military on an effort to create digital replicas of water and wastewater system environments — allowing experts to test and refine automated defensive approaches.
“Water systems are facing increasing cybersecurity risks, and with the Water Watch Center, we’re providing rural systems with trusted resources to secure our nation’s water infrastructure,” said NRWA Chief Executive Officer Matthew Holmes.
Industry Concerns and Regulations
Organizations like the NRWA previously fought efforts by the federal government to institute cybersecurity regulations, arguing that new rules would force water utilities to raise costs on customers. Those concerns have prompted several states, including New York, to pair water cybersecurity regulations with grant programs that pay for the required defensive systems.
The WWC is a significant step towards protecting the nation’s water infrastructure from cyber threats. With the partnership between the NRWA and DEF CON Franklin, smaller water utilities will have access to the resources and expertise they need to mitigate attacks and secure their systems.
- Rapid7
- Defendify
- Legato Security
- L1 Secure
- Sentinel Technologies
“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date.” - Jake Braun, co-founder of DEF CON Franklin
The WWC is a crucial initiative that will help protect the nation’s water infrastructure from cyber threats. As the program continues to grow and evolve, it is likely to have a significant impact on the cybersecurity of water utilities across the U.S.
Source: The Record