Is the new Water Cyber Shield Act too little, too late, and can a cyber group do it better? The experts weigh in benedict.collins@futurenet.com (Benedict Collins) | usagoldmines.com

Two US senators have proposed a new Water Cyber Shield Act to provide the EPA with additional funding and tools to conduct cybersecurity assessments on critical water infrastructure.

The act would provide $300 million annually to allow for upgrades to water utility infrastructure. Numerous coordinated attacks have been launched against US water infrastructure in recent years across 12 states, with 30 Minnesota utilities hit by Iran earlier this month.

But a separate Water Watch Center group has been set up to monitor 91% of the roughly 50,000 community water systems nationwide following a two-year pilot. The group, set up by DEF CON Franklin and the National Rural Water Association, will offer managed detection and response services provided by five cybersecurity firms.

Why are water utilities being attacked?

The FBI, CISA, NSA, and many more agencies have issued warnings about the increased threat to water utilities from Iran.

Water utilities are considered a low risk, high reward attack for state-sponsored hackers looking to cause as much damage as possible as many of the water control systems rely on internet connected operational technology (OT) devices and logic controllers.

These devices are widely deployed across water infrastructure to control water treatment and are connected to computers at monitoring stations. Theoretically if a hacker gained control of these systems, they could turn off the treatment of water or open sewage gates to contaminate water supplies.

Many water treatment systems are designed to last decades, with these OT devices and logic controllers expected to last as long as possible. But as new tech and hardware is developed, these devices stop receiving software updates that can put them at a greater risk of being attacked.

For many in the cybersecurity industry though, the Water Cyber Shield Act is too little, too late.

Expert perspectives on hardening water utilities

Will the Water Cyber Shield Act be passed?

Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:

While it’s always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it’s likely a far reach from what will actually happen. The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here)

I hate to say it, but historically speaking, this is likely to fail before making it to a vote, just like all other bills that have been attempted to improve water cybersecurity in the past. If we look at just the 118^th and 119^th Congress, we have had 9 bills introduced, as far as I’m aware, that pushed language that would have focused on either providing monetary assistance for, directly enforcing industry standards, and/or regulation around cybersecurity for water systems and CI, each varying in degree of what they would have provided and who they would have protected (rural vs non), but of those 9, all from within the 118th congress died within committees and without comments or markup, meaning no one even bothered to fight for them to get a vote across. Technically, the 4 from this congress (119) are still “pending’ but considering no movement has occurred on them, they will likely reach the same fate.

Ultimately, Congress has been unreliable in pushing forward regulation and standards towards CI for quite some time, and the mantle thankfully has been picked up by private organizations and security practitioners who wish to have a safer and more secure water source. Even though it shouldn’t be dependent on the goodwill of private citizens to protect public infrastructure.

Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn’t the first time we have had this situation happen before. So, my fingers are crossed, but I’m not holding my breath.

Too little, too late?

John Strand, Owner, Black Hills Information Security, Inc.:

I think this type of legislation is important, but it’s also long overdue. People have known about the security weaknesses in critical infrastructure, especially within municipalities, for well over a decade.

Unfortunately, this is another example of a reactive approach to cybersecurity. Too often, meaningful action doesn’t happen until the damage has already been done.

My concern is that by the time these programs are fully implemented and organizations begin benefiting from them, many of the municipalities with the same vulnerabilities that enabled recent attacks will have already been compromised.

It’s a positive step, but it’s arriving years after the underlying risks were widely understood. This is the kind of investment that should have been made more than a decade ago, not after the attacks have already demonstrated the consequences of inaction.

Is $300 million even enough?

Damon Small, Board of Directors, Xcape, Inc.:

The Water Cyber Shield Act attempts to address a major regulatory gap by granting the Environmental Protection Agency explicit authority to enforce baseline security standards and allocate $300 million annually for utility upgrades, but federal dollars alone cannot fix this sector’s systemic fragility.

Spread across roughly 50,000 community water systems nationwide, that funding yields a negligible $6,000 per facility, an amount that barely covers an initial architecture audit, let alone operational technology overhauls.

The industry already possesses robust reference architectures and standards for protecting control systems, so the primary barrier is execution rather than a lack of guidance. Furthermore, claiming that capital injections will solve the threat ignores the reality that maintenance windows are rare in continuous operational technology environments.

Rather than waiting on Congressional appropriations, security leaders and asset owners must immediately execute foundational controls: strictly isolate industrial control networks from corporate IT, eliminate publicly exposed management interfaces to the Internet, enforce multi-factor authentication, and replace default device credentials.

Operational security standards already exist; what utilities lack is not awareness, but the uptime flexibility to actually apply patches.