This initiative will target water, wastewater, electricity and natural gas utilities based in the United States that have a less-than-$100 million revenue. The three companies noted that this threshold covers about 97% of the industry.
Dragos will provide the operational technology cybersecurity solutions to the participants, enabling them to inventory connected devices and conduct remediation.
The implementation will be provided by Accenture, which will support these partners in deploying these technologies to their networks.
SANS Institute will conduct the training programs for the participants, which will focus on building the cybersecurity awareness of their personnel. On top of that, these utilities will be able to share best practices and lessons learned with each other within the ecosystem.
Recent events, such as more than a hundred water utility ransomware attacks last year, combined with warnings from federal agencies regarding Chinese and Russian interference in energy utilities, seem to justify this effort. Dragos CEO Robert Lee opined that criminal gangs and nation-states are becoming more interested in operational environments that power the country’s critical infrastructure. He added that the foundation would ensure that the companies that need it most will receive the software, hardware and training for free.
James Lyne, the SANS Institute CEO, warned that cybersecurity technologies are useless if the people managing them lack the know-how to use them. He argued that their effort would help those on the front lines of the critical infrastructure protection fight, namely those who keep the water flowing, power flowing and natural gas flowing.
Smaller utility companies often cannot afford both the cybersecurity solutions and the staff to manage them, leaving their pumping stations, valves, switches and other crucial equipment open to ransomware and state-sponsored attacks.
The new ecosystem, apart from being limited to 500 participants, will also have an undefined Maturity timeline. Elastic, a cybersecurity software firm, will assist in expanding the initiative, with the organizers suggesting that more firms will join in on the effort. The program does not include federal or state government support, with Accenture’s initiative being a separate endeavor.
It follows the National Rural Water Association’s effort to bolster its members’ cybersecurity capabilities following the ransomware attacks against water utilities in July, which saw five managed detection and response providers team up to share threat intelligence and mitigation details.
As federal efforts to counter ransomware and protect the US infrastructure seem to stagnate, with various state governments taking the matters into their own hands.
This new foundation aims to do the same, but for the smaller players in the industry that cannot afford the cybersecurity solutions that larger firms, such as American Water Group, can deploy themselves.
