Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity

Up to 500 under-resourced utilities will get access to a range of free cybersecurity software, hardware, deployment services and training through a new program offered by the global services company Accenture, the cybersecurity firm Dragos and the SANS Institute training organization. 

The three organizations announced the Community Cyber Resilience Foundation on Tuesday, offering to provide eligible utilities with operational technology-focused cybersecurity services and more. They are collectively investing $10 million into the foundation. 

The program is available to any U.S.-based water, wastewater, electric, and natural gas utilities with less than $100 million in annual revenue — which the companies said accounts for 97% of utilities. 

Participants will get access to cybersecurity tools from Dragos, which notifies organizations of the devices on their network and ways they can address vulnerabilities. 

Accenture will assist with deploying the tools and configuring them for participants. The company will also provide ongoing support for the utilities as they integrate the tools into their operations.

The SANS Institute will offer training to help build utilities’ employees capacity. 

The initiative follows breaches of more than 100 water utilities across the U.S.. Government agencies continue to warn of both Chinese and Russian cyberattacks on energy utilties, telecoms and more. 

Dragos CEO Robert Lee said cybercriminals and nation-states are “aggressively targeting utilities, attacking the operational environments that provide life-sustaining services to millions of Americans.”

The foundation “gives the utilities that need it most access to cybersecurity resources and training at no cost,” he added. 

Members of the program will also have access to one another, allowing them to share best practices and operational experience. 

“The best security technology in the world won’t protect a utility if its staff are not able to use it. The foundation puts training and skills in the hands of the people protecting the water, power, natural gas, and wastewater treatment systems that communities rely on,” said James Lyne, CEO of the SANS Institute.

The first phase of the program will involve 500 utilities and may expand depending on its success. 

Cyber defenders have for years warned the public that most of the utilities in the U.S. cannot afford the cybersecurity tools needed to protect themselves against an array of evolving threats that include ransomware gangs, nation-state actors and other cybercriminals eager to cause damage. 

Many utilities lack the funding, staffing and technological capacity to integrate cybersecurity tools — leaving thousands of pumps, valves, substations, and distribution networks vulnerable to attack. 

There is no federal or state government involvement in the program. The cybersecurity company Elastic will also offer technical support to help scale the program. 

There is no time limit on how long participants will have access to the program and Dragos said “other companies are already expressing interest in coming on board to grow it further.”

After the attacks on water utilities in July, the National Rural Water Association (NRWA) launched its own program involving five managed detection and response providers — Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies — who agreed to share threat information and data on vulnerability patches.

Federal efforts to improve the cybersecurity of utilities have stagnated, leaving states to create their own frameworks for protecting water, power, telecoms and more.