DEF CON hackers add new muscle to water utility protection

At the DEF CON hacker conference, the National Rural Water Association (NRWA) and DEF CON have launched a new program called the Water Watch Center. This initiative aims to provide free cyber-defenses to rural water systems in the US, specifically targeting smaller utilities serving fewer than 10,000 people. The program will initially fund five managed detection and response providers - Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies.

These providers will work together to detect and mitigate breaches while sharing information with the NRWA. The NRWA assists these small water and wastewater utilities across all 50 states, addressing the lack of a scalable cyber defense mechanism for these utilities. Jake Braun, who co-founded the DEF CON project in 2024, explains that the Water Watch Center functions as a pyramid.

At the top is the NRWA, followed by the managed detection and response providers' sensors, and then Franklin volunteers who fix issues or respond to instructions as needed. The program started with five initial MSSPs (Managed Security Service Providers) and plans to expand to ten, based on the ten CISA (Cybersecurity and Infrastructure Security Agency) regions.

Additionally, the Water Watch Center has partnered with Vanderbilt University to create digital twins of a few water and wastewater systems. Researchers will use red- and blue-team agents to test the system's automated detection and response capabilities, with the goal of deploying AI-based defense mechanisms to protect the 150,000 water utilities across the US.