DEF CON hackers launch Water Watch Center to defend small water utilities

DEF CON Franklin and the National Rural Water Association have launched the Water Watch Center, a program that delivers managed cybersecurity services to small water utilities that have no security staff of their own.

The launch came on Aug. 7 at the DEF CON hacker conference in Las Vegas. More than 30 Minnesota water systems were hit by intrusions in late July, and roughly 12 states have since reported similar activity. The U.S. Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency are running incident response. Officials suspect Iranian involvement but have not confirmed it.

The center is aimed at the bottom of the sector. Utilities serving fewer than 10,000 people make up 91% of the roughly 50,000 community water systems in the country. Most have no chief information security officer, no security operations center and no budget to hire either.

Five managed detection and response providers have signed on to serve those systems. Rapid7 Inc., Defendify Inc., Legato Security LLC, L1 Secure and Sentinel Technologies Inc. will exchange threat information and patches through a dedicated collaboration mechanism, then pass what they find to NRWA. The association acts as the national hub.

Behind the program sits a two-year field effort. DEF CON Franklin, a joint project of DEF CON and the University of Chicago Harris School of Public Policy’s Cyber Policy Initiative, recruited nearly 450 volunteer cyber experts and paired many of them with water and wastewater utilities in Arizona, Indiana, Oregon, Utah, Vermont, Washington and Wyoming. That work hardened individual plants. It also exposed the limits of volunteer labor against some 150,000 water and wastewater systems, counting wastewater plants and smaller non-community systems.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” said Jake Braun, co-founder of DEF CON Franklin and a former White House acting principal deputy national cyber director. Braun told The Record the mix of volunteers and hand-picked providers is intended to hold costs down for cash-strapped utilities.

Craig Newmark, the craigslist Inc. founder and a longtime backer of what he calls cyber civil defense, provided seed money. Vanderbilt University is applying research from the Defense Advanced Research Projects Agency’s CASTLE program to build digital twins of water systems, which will be used to test automated defenses. Work is already under way in Maryland to identify vulnerable rural systems.

Small water and wastewater systems tend to run legacy operational technology with exposed programmable logic controllers and weak credentials, said Matt Hartman, chief strategy officer at Merlin Group LLC. That turns fairly basic attack techniques into real operational risk. IT-focused monitoring may not register a direct interaction with one of those controllers.

“MDR can provide significant value for utilities without dedicated cybersecurity staff, but only if it has visibility into the operational environment,” Hartman told SiliconANGLE via email. He added that the reliance on philanthropic funding to stand the capability up “underscores how significant the resource gap remains.”

Kevin E. Greene, chief cybersecurity technologist for the public sector at privileged access management and identity security company BeyondTrust Corp., said many of these utilities start from further back. “If we are being honest, many small water systems are still operating below the cyber poverty line,” he said in comments provided to SiliconANGLE. The operating model has to “meet these municipalities where they are,” Greene said.

Philanthropy helps in the short run, Greene added. He does not think municipalities should have to rely on it for baseline cyber resilience on infrastructure communities use every day.

Image: SiliconANGLE/GPT Image 2