Industry Partners Launch $10 Million Initiative to Bolster Small Utility Cybersecurity
Dragos, Accenture, Sans Institute, and Elastic are pooling $10 million in resources to provide free operational technology (OT) cybersecurity support to small and rural utilities.
A significant new initiative, the Community Cyber Resilience Foundation, has been launched by a consortium of cybersecurity leaders to address the critical need for enhanced operational technology (OT) security among small and rural utilities. Spearheaded by Dragos, a prominent player in OT security, and backed by global consulting giant Accenture, training provider Sans Institute, and data analytics firm Elastic, the program aims to deliver $10 million worth of free cybersecurity support.
The foundation's creation stems from a recognition that smaller utilities, often operating with limited budgets and technical staff, are increasingly becoming targets for cyberattacks. These attacks can have devastating consequences, disrupting essential services like water and electricity. "We've seen globally that smaller utilities are increasingly the target of cyberattacks with the intent to create physical impact or disrupt operations of critical service providers like water and electricity companies," stated Katherine DiEmidio, vice president for public policy and government affairs at Dragos.
This effort builds upon Dragos' prior experience with its Dragos Community Defense Program, which offered free access to its security platform for utilities with annual revenues under $100 million. While that program successfully onboarded around 100 utilities, the need is far greater, with an estimated 50,000 utilities nationwide qualifying for such assistance. Dragos identified key challenges that hindered adoption, notably the lack of adequate hardware for installing security tools and insufficient staff training to effectively utilize them.
The Community Cyber Resilience Foundation is designed to overcome these barriers. Accenture will provide crucial deployment services, including expert configuration, integration, and ongoing support, aiming to close the "widening vulnerability gap" between large operators and smaller entities. "The company's contribution was designed to close the 'widening vulnerability gap - between large operators with the resources to invest in cybersecurity and smaller utilities that often lack those means,'" said Accenture CEO and Chair Julie Sweet.
Complementing the technical support, the Sans Institute will offer free training to equip utility staff with the necessary skills to manage and operate cybersecurity tools effectively. "The best security technology in the world won’t protect a utility if its staff are not able to use it," emphasized Sans CEO James Lyne. This training is vital for personnel responsible for protecting water, power, and other essential services.
Elastic will contribute by providing the essential log storage and search capabilities within the Dragos platform, enabling the foundation to scale its operations. "Elastic's support would help make 'advanced cybersecurity capabilities accessible to utilities that could not otherwise afford them,'" noted Elastic CEO Ashutosh Kulkarni. This ensures that even smaller organizations can leverage sophisticated threat detection and analysis tools.
The initiative is part of a broader national effort to fortify U.S. critical infrastructure against potential cyberattacks, particularly those aimed at causing widespread disruption. However, experts caution that while valuable, donated cybersecurity tools and services are not a complete solution. Josh Corman of the Institute for Security and Technology likened free cybersecurity tools to "free like puppies - not free like beer," highlighting the ongoing need for maintenance, skilled personnel, and dedicated resources.
Despite these caveats, the Community Cyber Resilience Foundation represents a significant step forward in addressing the cybersecurity vulnerabilities of smaller utilities. By combining technology, deployment services, and comprehensive training, the program aims to bolster the resilience of essential services and protect communities from the growing threat of cyberattacks on critical infrastructure.