Hackers bolster cyber defenses for water utilities
DEF CON expands its program to protect rural water systems from cyber threats.
1Cyber protection for rural water utilities
DEF CON hackers launched a new program to provide free cyber defenses to rural water systems in the US. The Water Watch Center program will assist small water utilities serving fewer than 10,000 people. Five security providers - Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies - will initially be funded. These providers will share threat information and collaborate with the NRWA.
2Scalable cybersecurity solution
Jake Braun, co-founder of DEF CON Franklin, noted that 98% of the 150,000 water utilities are small businesses lacking scalable cybersecurity mechanisms. Braun said, "We know MSSPs provide security for small businesses, why don't we do that?" The Water Watch Center will operate as a pyramid structure with NRWA at the top. MSSPs will detect vulnerabilities while Franklin volunteers address issues.
3AI-powered defense
The Water Watch Center partnered with Vanderbilt University to leverage DARPA's CASTLE program. This collaboration will create digital twins for several water and wastewater systems. Researchers will deploy red and blue team agents on these digital copies. Red team agents will attempt to hack the systems while blue team agents test automated detection and response capabilities. The ultimate goal is to provide AI-powered defense to water facilities across the US.
4Growing threat of cyber attacks
Recent weeks saw Iranian hackers targeting multiple water systems, mostly small community systems that exposed programmable logic controllers directly to the internet. While there's no evidence of AI use in these attacks, experts say it's only a matter of time. DEF CON Franklin has prepared a plan for this scenario.
5Role of volunteers
In 2024, 350 people volunteered for the DEF CON Franklin project, donating their time and skills to secure water facilities. Braun said, "We can take alerts from CISA and ISAC and deliver cybersecurity. The missing piece was a nationally scalable delivery mechanism." The Water Watch Center aims to fill this gap.
6Industry talent shortage
There's a shortage of 500,000 cybersecurity professionals. Braun stated, "The idea of magically finding 150,000 new people is a fantasy. There's no other way to combat the coming AI attacks." The Water Watch Center plans to train AI-based defense agents to address this shortage. Researchers will determine when blue team agents succeed and deploy them to water utilities.
7Importance of digital twins
The Water Watch Center will create digital twins of water and wastewater systems for cybersecurity testing. These digital replicas will help identify vulnerabilities in real systems. Red and blue team agents will battle on these digital twins, aiding the development of AI-based defense systems.
8Step toward national security
DEF CON's initiative is critical as cyber attacks on water utilities increase. Small water utilities often become targets due to inadequate security measures. The Water Watch Center aims to provide scalable cybersecurity solutions to these utilities. This program is seen as a significant step toward strengthening national security.