Most conversations about protecting critical infrastructure assume the operator can act once it knows the risk. For most utilities in the United States, that isn’t true.
Roughly 97% of utilities in the U.S. bring in less than $100 million in revenue. Many have no IT staff, let alone IT security or OT security professionals. Even when they understand the threat and want to act, spending on cybersecurity often means town votes, public utility commission approvals, and sign-off from mayors and city administrators who aren’t steeped in the problem. Doing the right thing is close to impossible for them. They sit below the cyber poverty line.
Today, together with Accenture and the SANS Institute, Dragos is announcing the Community Cyber Resilience Foundation, a new nonprofit built to change that. Below I’ll cover what it will do for underserved utilities, how we got here, and where we need your help.
When the Russia-Ukraine war started, smaller utilities were being actively targeted, and we felt we had to do something. Our mission is to safeguard civilization, not just to sell to those who can afford it.
So we launched the Dragos Community Defense Program for electric, gas, and water utilities under $100 million in revenue. Elastic joined us and made its software available to the utilities free of charge, which helped the program scale. Eligible utilities got our software for free, access to Dragos Academy for training, and membership in OT-CERT, which gives them a community of peers plus webinars, templates, and security guides to get started.
Over the past couple of years, we’ve onboarded more than 100 utilities across North America. In many of them we found major vulnerabilities, misconfigurations exposing them to risk, and active threats. These utilities needed help, and they got it. Working with these wonderful professionals has been a highlight for many of the staff at Dragos.
Free software only goes so far, and that turned out to be the real lesson. Many of these utilities had no one to install it. Some had no hardware to install it on. Others needed an initial assessment to understand where they stood before they could run a program. And even after onboarding, many lacked the time to keep using the technology.
Access was never the problem. Knowing help was available and adoption was.
When we took a majority investment from Accenture, one of my first conversations with Julie Sweet, Accenture’s chair and CEO, was about this. Whatever we do to pursue big markets has to also serve the mission and the communities that need help most and can least afford it. Julie didn’t pause for a second, and people across Accenture got to work right away. I was inspired but not surprised by how quickly they moved and how focused they were having worked with them for years.
The threat has moved past theory. More than 100 water utilities were attacked on the OT side in a single campaign earlier this year. More than 700 supermarkets were hit through internet-connected control systems. State actors have intruded into electric utilities and gas pipelines over the past several years with the intent to prepare for future disruption. Dragos handles many incident response cases that never get made public, and they all point to the same growing trend. And AI will make it faster for adversaries to find these facilities, identify their OT, and start operations against them.
Smaller utilities aren’t only a local concern. An adversary who compromises them can create problems for larger utilities and for national security. We have to act now.
Any electric, gas, or water utility in the U.S. under $100 million in revenue can apply through the Foundation to join the Community Defense Program. It includes everything the program offered before, plus three things that address the adoption barrier directly:
- Hardware. Financial contributions to the Foundation pay for hardware for utilities that need it.
- Deployment and operational support. In-kind services from Accenture cover initial assessments, deployment, configuration, and putting the technology to work.
- Workforce development. SANS courses and GIAC certifications are available to utility staff who want to grow their IT, cybersecurity, and OT expertise.
All of this is provided at absolutely no cost to the utilities, ever.
This doesn’t solve every problem, but it is a meaningful step in the right direction. Over time the Foundation will add more training, more support, and more hands-on help.
The Foundation launches with $10 million in resources for phase one. The goal is to onboard up to 500 utilities, on top of the more than 100 already in the Dragos Community Defense Program, as fast as they sign up and are ready to take part. Several more companies plan to contribute millions in resources, and we’ll announce them in the coming months.
The real target is much bigger. More than 50,000 U.S. utilities would qualify. My goal is to move through phase one quickly and get to the tens of thousands of utilities that need support.
Small utilities are the last mile of critical infrastructure. I have four children, and I want them to grow up with safe water and reliable power. Underserved utilities are where that gets decided.
We’ve watched small utilities do remarkable things once they get support. The Foundation’s website has a case study from Juneau, Alaska, where a few community members who cared enough applied to the Community Defense Program and had an outsized impact on the security of the local drinking water supply.
In Littleton, Massachusetts, a small utility was targeted by a state-sponsored campaign from the Chinese government trying to break into its operational technology. With their grit and dedication, our technology, the right government partners, and real commitment to the mission, they found the adversary, removed them, and kept their community safe. We can win.
We see stories like these again and again, public and non-public. These utilities are being targeted, and they will be targeted more. Supporting them isn’t optional.
If you work at a vendor that has security appropriate for small utilities and are willing to provide it at no cost, reach out and let’s talk about what you can contribute. Firewalls, hardware, and direct resources make a real difference for these utilities.
The most important thing, though, is getting the word out. Most of these utilities have no cybersecurity staff, so they aren’t in the security community and don’t follow security media. They’re heads down, keeping the water and power running for their communities. I have met people who run the utility, work in operations, and mow the lawns on Fridays. These are amazing people who have no spare cycles. Many don’t know this help exists.
The Foundation’s website has a ready-made note you can send to your local cooperative, municipal utility, or small utility operator, or you can write your own. That one message may be the most useful thing you do this year.
Let’s rally the community, let people know help is available, and finish phase one as fast as possible so we can bring in more resources and reach the tens of thousands of utilities still waiting.
We are a global company, and this need isn’t limited to the U.S. Utilities around the world are under-resourced too. Not every country’s situation looks like what small U.S. utilities face, but in many places the same problem applies.
We’re working with our partners to find ways to expand the program to other countries where it makes sense, so that we end up with a truly global answer. For now, phase one is focused on the U.S. We want to show that this model is worth investing in and that it can be done.
In the end, defense remains doable. Advanced threats, AI, and state actors don’t change that. If we come together and do security as a community, we can win.
