The group is seeking philanthropic grants, but its founder said the federal government ultimately needs to step in.
LAS VEGAS — A water industry trade group and a collective of volunteer cybersecurity experts are bringing free security services to small water utilities that desperately need help protecting their systems from hackers.
The DEF CON Franklin project on Friday announced thatit will pay cybersecurity firms to providetheir monitoring and protection products for free to water utilities serving fewer than 10,000 people. Those utilities, which account for more than 90% of the 50,000 community water systems in the U.S., are among the most digitally vulnerable, a danger highlighted byrecent Iran-linked attackson water systems across the country.
Five managed detection and response (MDR) providers — Defendify, Legato Security, L1 Secure, Rapid7 and Sentinel Technologies — will initially participate in the program, and they will share the threat intelligence they collect from utilities’ networks through a new Water Watch Center run by the National Rural Water Association (NRWA).
When MDR <a href="https://bitcomme.com/q4-wins-ai-finance-award-for-investor-relations-software/” title=”Q4 wins AI finance award for investor relations software”>software installed on a utility’s network detects a potential cyberattack or vulnerability, the vendor will alert the utility and provide a report on the problem. The utility can then either fix the problem itself or request help from a volunteer expert on Franklin’s roster.
“This is all about scale,” DEF CON Franklin organizer Jake Braun said in a Friday interview here on the sidelines of the DEF CON cybersecurity conference, the birthplace of the volunteer group. “Scaling delivery of cyber is where all the challenges fall.”
The MDR offering and watch center represent a significant expansion of Franklin’s work supporting the water sector. In late 2024, the group starteddispatching volunteers to help participating water utilitiesimplement basic cybersecurity measures, map their networks and write incident-response plans. But Friday’s announcement marks the beginning of an ambitious new era for the group that will see it directly fund commercial cybersecurity support for water utilities for the first time.
Recruitment and sharing
Each MDR provider offers services in slightly different ways, which will help Franklin identify the best model. “We want to be able to test them all out,” said Braun, the executive director of the University of Chicago’s Cyber Policy Initiative.
Franklin volunteers will handle the task of connecting the utilities to their MDR services, which Braun said turned out to be one of the most expensive parts of the process.
Franklin’s team picked the five initial MDR vendors because they already have water utilities among their customers, which gave them an understanding of utilities’ specific needs. Now, Braun said, the goal is to add “tens of thousands” more utilities. Franklin will probably recruit most of those utilities itself, he added, but the vendors also have a financial incentive to recruit them.
The project has already partnered with Maryland’s cybersecurity program to onboard rural utilities there.
The Water Watch Center plans to share the threat intelligence it gets from MDR vendors with WaterISAC, the industry’s information sharing and analysis center. “We’re working on anonymizing the data” first, Braun said.
WaterISAC, the Cybersecurity and Infrastructure Security Agency and other partners play an important role in keeping utilities informed about cyberattacks, Braun said, but utilities often struggle to implement the guidance that those groups publish. Franklin staffers recently met with a utility that has just two employees. “One of them, also, his job was to run the Fourth of July parade in town,” Braun said. “We can send them alerts all day and do all the assessments we want, but there’s nobody to go do anything with it.”
Call for government help
The project’s funding for MDR services and the Water Watch Center will come from grants. Initial seed money came from Craigslist founder and prolific cybersecurity philanthropist Craig Newmark, but Braun said he’s also waiting to hear back about two other “massive grants.”
The initiative has enough money to sustain its current operations, but scaling up to tens of thousands of utilities will require a far larger investment.
“Eventually, the federal government has to step in and pay for this,” Braun said.
Congress already funds rural water systems through a contract with NRWA in the agriculture policy law known as the Farm Bill. “They can just change the number,” Braun said. “This is so simple for Congress to just do.”
Franklin intends to significantly increase its conversations with congressional offices about the importance of water cybersecurity.
If the government doesn’t step in, “none of this is going to work, [and] these water utilities are going to be [screwed],” Braun said, using a stronger word than “screwed.”
Filed Under:Strategy,Cyberattacks,Threats
