Is the new Water Cyber Shield Act too little, too late, and can a cyber group do it better? The experts weigh in

Two US senators have proposed a new Water Cyber Shield Act to provide the EPA with additional funding and tools to conduct cybersecurity assessments on critical water infrastructure.

The act would provide $300 million annually to allow for upgrades to water utility infrastructure.

Numerous coordinated attacks have been launched against US water infrastructure in recent years across 12 states, with 30 Minnesota utilities hit by Iran earlier this month .

But a separate Water Watch Center group has been set up to monitor 91% of the roughly 50,000 community water systems nationwide following a two-year pilot.

The group, set up by DEF CON Franklin and the National Rural Water Association, will offer managed detection and response services provided by five cybersecurity firms.

Why are water utilities being attacked? The FBI, CISA, NSA, and many more agencies have issued warnings about the increased threat to water utilities from Iran.

Water utilities are considered a low risk, high reward attack for state-sponsored hackers looking to cause as much damage as possible as many of the water control systems rely on internet connected operational technology (OT) devices and logic controllers.

These devices are widely deployed across water infrastructure to control water treatment and are connected to computers at monitoring stations.

Theoretically if a hacker gained control of these systems, they could turn off the treatment of water or open sewage gates to contaminate water supplies.

Many water treatment systems are designed to last decades, with these OT devices and logic controllers expected to last as long as possible.

But as new tech and hardware is developed, these devices stop receiving software updates that can put them at a greater risk of being attacked.

For many in the cybersecurity industry though, the Water Cyber Shield Act is too little, too late.

Expert perspectives on hardening water utilities Will the Water Cyber Shield Act be passed? Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs: While it's always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it's likely a far reach from what will actually happen.

The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here ) Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn't the first time we have had this situation happen before.