Topics:
A collaborative initiative between six Massachusetts communities’ water and wastewater facilities is turning around the cybersecurity posture for these utilities, and there’s hope it turns into a model for others nationwide struggling in the water sector.
Gus Serino, President of I&C Secure and a longtime security practitioner in water and wastewater, explained how he envisioned this model for OT security after he attended a virtual security conference where a similar IT collaborative presented on its success around shared cost savings and leveraging collective buying power. In Serino’s case, eight water facilities joined to apply for a grant to fund the initiative (two since dropped out). The grant was approved, and the collaborative was off and running. So far, the progress has mostly been in building trust between the disparate participants and the development of a security monitoring strategy.
“We're just trying to move it forward. I think taking a one-to-many approach—one cyber OT (operational technology) person who's knowledgeable in helping these utilities who are looking for prioritization help, is a good way for us to help efficiently move the needle forward,” Serino explained.
The group meets regularly to pool experience and resources, as well as information-sharing between them, Serino explained.
“I think as time goes on, there'll be almost mutual aid, but that really hasn't materialized at this point,” he said. The security monitoring strategy is an early win, with funding providing for a solution that is scalable across the utilities involved, augmenting existing controls to put these organizations in a more secure place, Serino said.
“We got a relatively maintainable, sustainable cost-effective security monitoring strategy in place to help,” Serino said. “Other stuff is really just more information sharing, understanding threats and risks.”
The water sector is notoriously under-resourced, with most of the nation’s 55,000 community water systems scrapping for every dollar and every bit of OT security expertise, while keeping critical systems available—and most of all—keeping the water clean and running. Serino said that IT help is often shared between town offices and very few have anything resembling an OT security team to deal with protection of control systems.
“They’re focusing on things like water quality issues, and even if they recognize that there’s an issue with cybersecurity, it’s not really ranking in their order of priorities for the community,” Serino said. “We recognize that there's a real risk here. … We're trying to get at least the low-hanging fruit taken care of. There's nothing resembling an OT team, so they rely on outsourced systems integrators to handle the programming of the control system. Cybersecurity is never really—or very rarely—part of the conversation so is it a knowledge issue and a money issue.”
Moving forward, Serino said the collaborative is applying for additional grants and funding to sustain the effort for at least another year.
“Then I'm hoping this gets some traction and some other states start to take the same approach,” he said. “There's a lot of folks in this community who could really [provide] some help.”
Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.
