Accenture, Dragos and the SANS Institute have launched the Community Cyber Resilience Foundation, a nonprofit that will give up to 500 under-resourced U.S. water, electric and natural gas utilities operational technology security software, hardware, deployment services and training at no cost.
The three organizations said on Oct. 20 that they are making an initial combined commitment of approximately $10 million in funding and services. Eligible utilities are U.S.-based water, wastewater, electric and natural gas operators with less than $100 million in annual revenue. Participants receive the Dragos Platform, Accenture deployment services, SANS ICS/OT training, funding for the equipment needed to run the platform, and access to a peer community of utilities. Elastic supplies the log storage and query engine inside the Dragos Platform.
The foundation builds on the Dragos Community Defense Program, which already gives more than 100 utilities free access to the platform. The announcement came at an Ohio roundtable and cites a recent surge in attacks on more than 100 U.S. water systems across over a dozen states.
The announcement supplies the numbers that size the job. It says more than 97% of utilities fall under the revenue threshold, which it counts as more than 50,000 organizations that may need support. A first phase of up to 500 utilities therefore reaches about 1% of them at most.
In our reading, the training and deployment lines carry as much weight as the software, because a monitoring platform only helps a utility that has someone to read its alerts. James Lyne, CEO of SANS, framed it the same way in the announcement: “The best security technology in the world won’t protect a utility if its staff are not able to use it.”
A utility under the threshold can check eligibility on the foundation’s site. Larger operators that depend on small utilities can ask those suppliers whether they have applied. Earlier coverage here of compromised refrigeration controllers and exploitation of a Siemens Software Center flaw shows the same exposure in industrial settings.
