Title: Dragos Teams with Accenture and SANS Institute to Boost Cybersecurity for Small Utilities
In a significant initiative aimed at enhancing the cybersecurity framework for small and rural utilities, Dragos, a frontrunner in operational technology (OT) security, has joined forces with the consulting behemoth Accenture and the renowned SANS Institute. Together, they have announced the launch of the Community Cyber Resilience Foundation, an ambitious program offering $10 million in free cybersecurity support specifically designed for these often under-resourced entities.
The motivation behind this initiative stems from the growing trend of cyberattacks targeting smaller utilities, which handle essential services like water and electricity. Katherine DiEmidio, Vice President for Public Policy and Government Affairs at Dragos, emphasized the increasing threats faced by these utilities, noting that their vulnerability could lead to significant physical disruptions. “Smaller utilities are increasingly the target of cyberattacks with the intent to create physical impacts or disrupt operations of critical service providers,” DiEmidio remarked. Rather than merely acknowledging the issue, Dragos aims to take proactive measures to enhance security in these regions.
The foundation builds on Dragos’s previous efforts, particularly the Dragos Community Defense Program, which was launched following a series of cyberattacks by Russian state actors against U.S. utilities. The initial program provided free access to the Dragos security platform for electric, gas, and water utilities with annual revenues under $100 million. With around 100 utilities signed up so far, DiEmidio noted a striking contrast between the number currently engaged and the estimated 50,000 across the nation that could benefit from such support.
This gap highlights a deficiency in both adoption and preparedness within smaller utilities. DiEmidio articulated a critical insight gained from earlier efforts: simply providing cybersecurity tools for free does not guarantee their effective use. Many small utilities grapple with inadequate hardware and staff who lack the necessary skills and training to implement these technologies effectively. Therefore, the Community Cyber Resilience Foundation is designed as an evolution of their efforts, leveraging partnerships to confront these challenges head-on.
Accenture’s role in this foundation will include deployment services, which encompass configuration, integration, and ongoing support for the utilities that opt into the program. According to Accenture CEO Julie Sweet, the aim is to bridge the widening gap in cybersecurity capabilities between well-funded large operators and smaller, often vulnerable utilities. This approach acknowledges that while many utilities desire to implement robust cybersecurity measures, they frequently lack the financial means and resources to do so.
The SANS Institute will further fortify the initiative by offering free training programs. SANS CEO James Lyne asserted the necessity of equipping staff with the knowledge and skills required to maximize the effectiveness of advanced security technologies. “The best security technology in the world won’t protect a utility if its staff are not able to use it,” he stressed, underscoring the critical link between training and effective cybersecurity.
Elastic, known for its data analytics and search capabilities, will contribute by providing essential log storage and search functionalities within the Dragos cybersecurity platform, facilitating scalability that smaller utilities urgently need. Ashutosh Kulkarni, CEO of Elastic, noted that their involvement aims to make advanced cybersecurity solutions accessible to those who typically cannot afford them.
The foundation emerges amid escalating concerns over the security of U.S. critical infrastructure, particularly in light of geopolitical tensions and potential adversarial cyber strikes. The initiative has garnered attention from various stakeholders within the cybersecurity community, with experts acknowledging the importance of addressing vulnerabilities in smaller utilities but also cautioning that merely handing out free tools is not a catch-all solution. Josh Corman, an executive at the Institute for Security and Technology, highlighted that the challenges of implementing free cybersecurity tools are akin to the responsibilities of adopting a pet—owners must be prepared to care for and maintain their new obligations.
While the Dragos foundation is making strides in overcoming some of these barriers through partnerships with Accenture, SANS, and Elastic, Corman posited that financial constraints often hinder even well-resourced tools from being used effectively by the least equipped utilities. He stated, “Many of the most important operators…just don’t have the staff or the budget to take advantage of cybersecurity tools.”
Amid these challenges, Dragos continues to seek additional partners to ensure the long-term sustainability of the foundation beyond its inaugural year. DiEmidio emphasized the need for broader collaboration, inviting contributors from various sectors, including local and state governments, to join efforts in raising awareness and delivering critical resources to utilities.
“There’s a huge problem. There are 50,000 utilities across the country that could use help, and there’s more than enough work to go around,” she said, underscoring a collective responsibility to safeguard essential services that underpin public health and safety.
The newly formed foundation not only aims to bolster cybersecurity for smaller utilities but is also envisioned as a prototype for future collaborations that can address the myriad of complexities facing U.S. critical infrastructure in the face of modern cyber threats. As the technological landscape continues to evolve, partnerships like this may serve as vital lifelines for those operating on the front lines of national security.