Is the new Water Cyber Shield Act too little, too late, and can a cyber group do it better? The experts weigh in

In a bid to bolster cybersecurity for critical water infrastructure, two U.S. senators have introduced the Water Cyber Shield Act. The act would provide the EPA with additional funding and tools to conduct cybersecurity assessments, specifically allocating $300 million annually to upgrade water utility infrastructure. Since last year, numerous coordinated attacks have targeted U.S. water infrastructure across 12 states, with 30 Minnesota utilities recently hit by Iran.

However, a separate organization called Water Watch Center, established by DEF CON and the National Rural Water Association, aims to monitor 91% of the approximately 50,000 community water systems nationwide. They will offer managed detection and response services provided by five cybersecurity firms, unlike the proposed act which falls short according to some experts.

Experts are divided on the effectiveness of the Water Cyber Shield Act. Dahvid Schloss, a cybersecurity expert, doubts the bill's chances of passing, stating that it resembles a previous failed attempt in 2023. John Strand, the owner of Black Hills Information Security, believes that the legislation is overdue and should have been implemented decades ago, criticizing it as a reactive approach to cybersecurity.

Damon Small, a board member at Xcape, Inc., acknowledges the need for the act but emphasizes that federal funding alone is insufficient to address the sector's systemic vulnerabilities.