Franklin project adds new security providers, employs digital twins and AI<\/p>\n
DEF CON hackers expanded their efforts to provide free cyber-defenses to rural water systems in the US to include managed detection and response providers, digital twins, and AI agents.<\/p>\n
On Friday, at the annual hacker\u2019s conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers – Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies – to help small water utilities serving fewer than 10,000 people detect and mitigate breaches.\u00a0<\/p>\n
The security providers will exchange threat info and share that with the NRWA, which provides technical assistance and operational support to small water and wastewater utilities across all 50 states.<\/p>\n
\u201cWe've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there\u2019s 150,000 of them, and 98 percent of them are small businesses,\u201d\u00a0 Jake Braun told The Register during an interview at DEF CON.<\/p>\n
Braun co-founded the Franklin project at DEF CON in 2024, and 350 people signed up that year to donate their time and talent to securing water facilities.<\/p>\n
\u201cWe groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses – it\u2019s MSSPs,\u201d Braun said. \u201cSo why don\u2019t we just do that?\u201d<\/p>\n
He described the new Water Watch Center as a pyramid, with the NRWA at the top, the managed detection and response providers\u2019 sensors hunting for security vulnerabilities across the utilities\u2019 networks, and then Franklin volunteers fixing issues or responding to instructions as needed.<\/p>\n
\u201cWe have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions,\u201d Braun said. \u201cAnd then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we\u2019re not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That\u2019s been the missing piece: there has been no delivery mechanism for cybersecurity that\u2019s scalable nationally – that's what this is.\u201d<\/p>\n
Suspected\u00a0Iranian hackers\u00a0have hit numerous water systems in recent weeks, and most were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. There\u2019s no indication that the attackers used AI to help plan or carry out these digital disruptions. However, as both cyber and national security experts told The Register during conversations on the sidelines of Black Hat and DEF CON, it\u2019s only a matter of time until that happens.<\/p>\n
DEF CON Franklin has a plan for that scenario, too.<\/p>\n
The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few WWC water and wastewater system environments, and then researchers will deploy both red- and blue-team agents across these digital dupes.<\/p>\n
The red-team attack agents try to hack the water systems, testing the blue-team defenders\u2019 automated detection and response capabilities, with the eventual goal of deploying AI-based defense to water and wastewater facilities across the US.<\/p>\n
\u201cThey let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities,\u201d Braun said.<\/p>\n
\u201cThere's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things.\u201d \u00ae<\/p>\n