What resources do small utilities need to defend against cyberattacks? | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"What resources do small utilities need to defend against cyberattacks?\"> <meta property=\"og:description\" content=\"In the country\u2019s mission to protect critical infrastructure, more can be done to defend small community water, electricity and gas providers against cyber threats.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-03-13T18:08:50+00:00\"> <meta name=\"author\" content=\"mbracken\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1710269227g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css,\/wp-content\/plugins\/embedpress\/Gutenberg\/dist\/blocks.style.build.css?m=1709662998\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-content\/plugins\/embedpress\/assets\/css\/embedpress.css,\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1710265906\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\">\n<link rel=\"stylesheet\" id=\"all-css-10\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-includes\/css\/dashicons.min.css,\/wp-content\/plugins\/embedpress\/assets\/css\/plyr.css?m=1710269227\" type=\"text\/css\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/79718\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.4.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=79718\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fwhat-resources-do-small-utilities-need-to-defend-against-cyberattacks%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fwhat-resources-do-small-utilities-need-to-defend-against-cyberattacks%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-79718 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.348639455782\">\n<div class=\"single-article__header-content\" readability=\"32.114695340502\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/commentary\/\"> <span>Commentary<\/span> <\/a> <\/li>\n<\/ul>\n<p> In the country\u2019s mission to protect critical infrastructure, more can be done to defend small community water, electricity and gas providers against cyber threats. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"427\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks.jpg?resize=640%2C427&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg 3100w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=2048,1366 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=1012,675 1012w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks-1.jpg?resize=1264,843 1264w\" sizes=\"(max-width: 1012px) 100vw, 1012px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"51.11572265625\"><body readability=\"102.66104756171\"><\/p>\n<p>Today, small utilities are on the front lines of cyberattacks, yet they often fall through the cracks of well-intentioned programs and public-private partnerships that aim to secure the nation\u2019s critical infrastructure. Community utilities that ensure we have power, clean water and fuel to heat homes now find themselves defending against highly motivated adversaries with financial and political agendas.<\/p>\n<p>In January, FBI Director Christopher Wray confirmed that Chinese government-backed hackers are <a href=\"https:\/\/cyberscoop.com\/feds-chinese-hacking-operations-have-been-in-critical-infrastructure-networks-for-five-years\/\">already positioned<\/a> in that very infrastructure, preparing to cause real-world harm. And attacks against critical infrastructure are no longer a theoretical possibility. At the end of last year, the hacktivist group CyberAv3ngers targeted Israeli-made programmable logic controllers (PLCs), resulting in <a href=\"https:\/\/cyberscoop.com\/pennsylvania-water-facility-hack-iran\/\">a compromise at a Pennsylvania water utility<\/a>, as well as other entities in the United States and globally.<\/p>\n<p>Water utilities such as the one targeted in Pennsylvania protect our community\u2019s vital resources but lack the proper resources to do so. Now more than ever, these organizations need both funding and expertise to buy and deploy updated equipment and hardware, as well as critical tools for cyber protections. However, securing these systems is not as simple as a funding issue. Not only are they operating within extremely limited budgets, but their purchases and investments approvals are screened through a vetting process that wasn\u2019t built to take into account cybersecurity needs.<\/p>\n<p><strong>Understanding the need<\/strong><\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Small utilities have limited resources for cybersecurity yet are crucial to the communities they serve, as well as to national security. According to the Environmental Protection Agency, small public water systems represent more than 90% of the nation\u2019s community water systems. Many of the nation\u2019s almost 3,000 public power companies and electric cooperatives are small or rural as well. Adversaries are targeting organizations of all sizes in order to cause disruption of essential services or create fear among the public.<\/p>\n<p>Smaller organizations make easy targets because they often do not have the same level of resourcing to protect their systems. For some small utilities, the limitations are simply financial. They don\u2019t have the budget for new equipment and technology or to recruit cybersecurity personnel. For others, the challenges are even more foundational. They may not have even a single dedicated staff member focused on cybersecurity and are subject to complicated spending approval processes and oversight programs that are not designed to prioritize or even allow cybersecurity investment. And so they face the growing threat environment without the expertise to fully address cybersecurity risk, especially when it comes to threats against the operational technology that run the physical environments within critical infrastructure, such as industrial control systems that open circuit breakers at an electricity distribution station or operate water pumping stations.<\/p>\n<p>Partners across government and industry are coordinating more closely than ever to protect critical assets, functions and services across sectors. CISA, the FBI and other agencies routinely share advisories on vulnerabilities with industry. The North American Electric Reliability Corporation brings government and industry leaders together in <a href=\"https:\/\/cyberscoop.com\/gridex-electric-sector-ukraine\/\">GridEx<\/a>, a large-scale exercise, to practice what response and recovery would look like during a coordinated attack on the grid. But not all critical infrastructure is starting from the same place when it comes to defending against cyber threats, and, for many, just prioritizing and acting on information is a challenge. Better coordination with the federal government will remain insufficient if utilities lack the capacity to build defensible systems. <\/p>\n<p><strong>Closing the resource gap for collective defense<\/strong><\/p>\n<p>When it comes to supporting utilities in their mission to defend their community infrastructure against cyber threats, we need to offer resources they need now. For some, this will be tools to start building a basic cybersecurity program. In addition to technology solutions, this includes support with things like tabletop exercises and fully implementing best practices or critical controls, such as the <a href=\"https:\/\/hub.dragos.com\/guide\/5-critical-controls\">5 ICS Cybersecurity Critical Controls<\/a>. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>But if we really want to help small utilities defend against cyber threats, we have to close the resource gap. Cybersecurity and operational reliability go hand in hand, and budgets need to reflect this. Budgeting processes need to include cybersecurity needs as baseline requirements and they need to be informed by cyber expertise. And costs for cybersecurity investment need to be recoverable. We can\u2019t make utilities choose between reliability and security. Our communities need both.<\/p>\n<p>Greater funding will be insufficient without faster and more straightforward access to the fundamental cybersecurity tools and technology that operators need now. Recent grant programs to assist states and communities in closing the cybersecurity resource gap, such as the Department of Homeland Security\u2019s <a href=\"https:\/\/www.cisa.gov\/state-and-local-cybersecurity-grant-program#:~:text=Funding%20from%20the%20State%20and,SLT%20governments%20and%20Tribal%20governments.\">State and Local Cybersecurity Grant Program<\/a>, are a start, but there are still process hurdles that slow resources from reaching the operators who need them, as well as oversight challenges locally that delay and prevent essential cybersecurity investments. Grant money movement is slow and has to flow through many checks and balances, for good reason. And most small utilities don\u2019t have grant writers, or staff with roles intended to find, apply for and track all the requirements that come with grants. <\/p>\n<p>At Dragos, we understand the challenges that small electricity, water and gas utilities face in accessing these tools, so we recently launched our Community Defense Program to help them build critical cyber protections faster through no-cost access to our platform software and other resources. We share in our collective mission to protect the nation\u2019s critical infrastructure and this program is us putting action behind our words.<\/p>\n<p>Individual companies and government agencies can\u2019t solve the problem alone, but we can each consider where we can best contribute, so we are working together to get resources in the hands of operators faster and protect our communities better. Let\u2019s close the resource gap by making it easier for small utilities to access the tools and information they need when they need it most.<\/p>\n<p><em>Robert M. Lee is the CEO and co-founder of Dragos, a company that focuses on cybersecurity for industrial controls systems and operational technology environments. <\/em><\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.225621414914\">\n<div class=\"author-card\" readability=\"12\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/03\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks.png?w=640&ssl=1\" alt=\"Robert M. Lee\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Robert M. Lee<\/h4>\n<p> Robert is CEO and co-founder of Dragos, a company that focuses on cybersecurity for industrial controls systems and operational technology environments. He also serves on the Department of Energy’s Electricity Advisory Committee as the vice chair of the DOE\u2019s Grid Resilience for National Security Subcommittee, and is a member of the World Economic Forum’s subcommittees on Cyber Resilience for the Oil & Gas and Electricity communities. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What resources do small utilities need to defend against cyberattacks?<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[280,413,78,1682,1066],"tags":[284,415,86,1683,1067],"class_list":["post-2711","post","type-post","status-publish","format-standard","hentry","category-commentary","category-critical-infrastructure","category-cybersecurity","category-gridex","category-water-sector","tag-commentary","tag-critical-infrastructure","tag-cybersecurity","tag-gridex","tag-water-sector"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/commentary\/\" rel=\"category tag\">Commentary<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/critical-infrastructure\/\" rel=\"category tag\">critical infrastructure<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/gridex\/\" rel=\"category tag\">GridEx<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/water-sector\/\" rel=\"category tag\">water sector<\/a>","tag_info":"water sector","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2711"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2711\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":2711,"date":"2024-03-13T13:08:50","date_gmt":"2024-03-13T18:08:50","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=79718"},"modified":"2024-03-13T13:08:50","modified_gmt":"2024-03-13T18:08:50","slug":"what-resources-do-small-utilities-need-to-defend-against-cyberattacks","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/03\/13\/what-resources-do-small-utilities-need-to-defend-against-cyberattacks\/","title":{"rendered":"What resources do small utilities need to defend against cyberattacks?"},"content":{"rendered":"