DEF CON hackers add new muscle to water utility protection

DEF CON hackers expanded their efforts to provide free cyber-defenses to rural water systems in the US to include managed detection and response providers, digital twins, and AI agents. On Friday, at the annual hacker's conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers - Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies - to help small water utilities serving fewer than 10,000 people detect and mitigate breaches. The security providers will exchange threat info and share that with the NRWA, which provides technical assistance and operational support to small water and wastewater utilities across all 50 states. We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there's 150,000 of them, and 98 percent of them are small businesses," Jake Braun told The Register during an interview at DEF CON. Braun co-founded the Franklin project at DEF CON in 2024, and 350 people signed up that year to donate their time and talent to securing water facilities. We groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses - it's MSSPs," Braun said. So why don't we just do that?" He described the new Water Watch Center as a pyramid, with the NRWA at the top, the managed detection and response providers' sensors hunting for security vulnerabilities across the utilities' networks, and then Franklin volunteers fixing issues or responding to instructions as needed. We have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions," Braun said. And then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we're not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That's been the missing piece: there has been no delivery mechanism for cybersecurity that's scalable nationally - that's what this is." Suspected Iranian hackers have hit numerous water systems in recent weeks, and most were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. There's no indication that the attackers used AI to help plan or carry out these digital disruptions. However, as both cyber and national security experts told The Register during conversations on the sidelines of Black Hat and DEF CON, it's only a matter of time until that happens. DEF CON Franklin has a plan for that scenario, too. The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few WWC water and wastewater system environments, and then researchers will deploy both red- and blue-team agents across these digital dupes. The red-team attack agents try to hack the water systems, testing the blue-team defenders' automated detection and response capabilities, with the eventual goal of deploying AI-based defense to water and wastewater facilities across the US. They let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities," Braun said. There's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things." (R)