Water utilities group partners with DEF CON offshoot for Water Watch Center

Water utilities group partners with DEF CON offshoot for Water Watch Center

A national water association is creating a program designed to provide threat intelligence and cybersecurity services to underfunded water and wastewater systems across the U.S.

On Friday, the National Rural Water Association (NRWA) launched a partnership with DEF CON Franklin — an organization that has sought to pair volunteer cybersecurity experts with cash-strapped water systems in need of their expertise.

The Water Watch Center (WWC) will provide direct support to smaller water utilities to mitigate attacks, including the recent string of incidents that have impacted water systems in at least 12 states.

The program will see five managed detection and response providers work with DEF CON Franklin and the NRWA to offer cyber services for water utilities serving fewer than 10,000 people. There are over 50,000 community water systems across the U.S. and 91% of them serve fewer than 10,000 people.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” said Jake Braun, the co-founder of DEF CON Franklin and former cyber official in the Biden administration.

“Our incredible Franklin volunteers will support the effort to keep costs down for cash-strapped utilities fending off adversaries like the Iranian Red Guard or Chinese Military,” Braun said. "To further accelerate the effort, we hand-picked cyber providers who already support water utilities. These folks walk in the door knowing the intricacies of cybersecurity in a water utility environment.”

The providers include Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies.

The companies will share threat information and data on vulnerability patches with the NRWA, which will operate as a hub.

The program emerged days after water utilities in Minnesota, Michigan, Georgia, South Dakota and several other states reported cyberattacks on their operational technology, as the scope of a campaign allegedly linked to Iranian hackers continues to grow.

On Friday, water utilities in two New Jersey towns came forward to say they had also been hacked as part of the campaign.

DEF CON Franklin emerged two years ago among veterans of the popular security conference. It recruited 450 volunteer cyber experts, pairing many of them with water and wastewater utilities in Arizona, Indiana, Oregon, Utah, Vermont, Washington, and Wyoming.

The effort was successful but exposed the difficulty of scaling cybersecurity services to the country’s 150,000 water and wastewater utilities — which include the 50,000 community systems and 100,000 public water systems that serve schools, factories, office buildings and hospitals. There are also thousands of water systems that serve temporary populations like those at gas stations or campgrounds.

The WWC has already started work in Maryland to identify rural water utilities in need of assistance, particularly those supporting military facilities.

“Water systems are facing increasing cybersecurity risks, and with the Water Watch Center, we’re providing rural systems with trusted resources to secure our nation’s water infrastructure,” said NRWA Chief Executive Officer Matthew Holmes.

Officials behind the WWC said they are also working with Vanderbilt University and the U.S. military on an effort to create digital replicas of water and wastewater system environments — allowing experts to test and refine automated defensive approaches.

Organizations like the NRWA previously fought efforts by the federal government to institute cybersecurity regulations, arguing that new rules would force water utilities to raise costs on customers.

Those concerns have prompted several states, including New York, to pair water cybersecurity regulations with grant programs that pay for the required defensive systems.