Waco’s Water Network Shows Why Utilities Need Clear Cybersecurity Ownership

Summary

Drawing on Waco’s experience, the author argues that utilities should assign network-wide accountability, inventory cellular-connected equipment, and use microsegmentation to protect water systems. Project Watershed 250 offers Texas utilities assessments and hardening.

Key points

• The author says Waco’s utility network included unexpected systems such as a library and municipal golf course register, and that nobody had been tasked with inventorying the network.
• CISA identified more than 100 compromised water and wastewater systems during July, often involving controllers connected directly to cellular modems; federal agencies had not attributed the late-July incidents.
• The article says cellular-connected controllers can be missing from asset lists and network scans, and recommends matching carrier invoices against devices and sites.
• The author recommends assigning one person responsibility for every device on the utility network and using microsegmentation to restrict plant controls to necessary communications with SCADA servers.
• The author reports Waco segmented five treatment plants in 43 days, using operating funds and an existing contract.
• Project Watershed 250 is described as a six-month Texas pilot offering water utilities red-team testing, vulnerability assessments, and help hardening findings at no cost.

People

Vendors

Products