DEF CON Hackers Launch Water Watch Center to Bolster Small Utility Cybersecurity
DEF CON Franklin and the National Rural Water Association have launched the Water Watch Center, a new initiative providing free cybersecurity services, including managed detection and response, to small US water utilities.
DEF CON hackers are expanding their efforts to protect rural water systems in the US by introducing a new program called the Water Watch Center. This initiative, a collaboration between DEF CON Franklin and the National Rural Water Association (NRWA), aims to provide crucial cybersecurity services to small water utilities that often lack the resources to defend themselves against increasingly sophisticated threats.
The Water Watch Center will initially partner with five managed detection and response (MDR) providers: Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies. These providers will monitor the networks of small water utilities serving fewer than 10,000 people, detecting and helping to mitigate breaches. The MDR providers will also share threat intelligence with the NRWA, which offers technical and operational support to small water and wastewater utilities nationwide.
Jake Braun, co-founder of the DEF CON Franklin project, explained that the initiative addresses a critical gap in cybersecurity delivery for the nation's vast number of small water utilities. "We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses," Braun stated. The Water Watch Center is designed to be a scalable solution, leveraging the expertise of MSSPs (Managed Security Service Providers) to provide a much-needed service.
The program's structure envisions the NRWA at the apex, with MDR providers' sensors actively hunting for vulnerabilities across utility networks. Volunteers will then assist in responding to alerts or implementing necessary fixes. Braun indicated plans to expand the number of MSSP partners to ten, aligning with CISA's ten regions, and to integrate volunteer support for a comprehensive defense strategy.
This effort comes at a critical time, as numerous water systems, particularly small ones, have been targeted by suspected Iranian hackers who exploited internet-exposed programmable logic controllers (PLCs) using weak or default passwords. While these recent attacks did not appear to involve AI, experts warn that it is only a matter of time before threat actors leverage artificial intelligence in their operations.
To prepare for future AI-driven attacks, the Water Watch Center is also partnering with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This collaboration will involve creating digital twins of water and wastewater system environments. Researchers will then deploy red- and blue-team AI agents within these simulated environments to test and refine automated detection and response capabilities.
The ultimate goal of the AI research is to train agents that can be deployed to defend water and wastewater facilities across the US. "There's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things," Braun emphasized, highlighting the necessity of AI-powered defenses.
The Water Watch Center represents a significant step forward in securing critical water infrastructure, combining human expertise with advanced technological solutions to address the growing threat landscape. By focusing on small utilities and embracing cutting-edge AI research, the initiative aims to build a more resilient and secure water sector.