UnDisruptable27 Newsletter: “The threat comes from cyber, but the solutions come from engineering. It’s not shields up. It’s connections down.”

Dear Fellow Protectors,

How can research and development improve the cybersecurity of water utilities? That was the question before the House Science, Space, and Technology Committee’s Subcommittee on Environment last week as Josh testified on our work building the UnDisruptable27 project.

From the outset, it was clear that our message was getting through on Capitol Hill. Nearly every Congressperson referenced the connection between water and healthcare delivery. One member from Texas even asked Josh to walk through how exactly a disruption to water could impact a specific healthcare facility in Houston! We came in expecting to do some educating about cascading failures due to dependencies, but the Committee members made plain that their focus on water was in part due to its foundational, cross-sector nature.

In listening to the testimony provided by Josh’s fellow witnesses, it’s also evident that policymakers are open to implementing non-cyber solutions to address cyber problems. 

• Dave Hinchman, who leads a Government Accountability Office IT and cybersecurity team, emphasized sector governance and strategic planning as a core element of risk reduction.

• Ginger Wright, an Idaho National Laboratory program manager (and U27 volunteer!), spoke about the importance of Cyber-Informed Engineering and the use of unconnected devices, like a time delay relay, to prevent pumps from burning out due to a flood of commands.

• Nicole Tisdale, a key voice in the Cyber Civil Defense community, highlighted the looming workforce cliff for rural water: 57% of their operators intend to retire over the next ten years.

It was the perfect panel for validating approaches that don’t start at merely preventing access. As Josh said to the Committee: “The threat comes from cyber, but the solutions come from engineering. It’s not shields up. It’s connections down.”

To tailor our testimony to the members of the Science Committee, Josh included recommendations drawn from U27’s research design and methodology. After all, though we aim to scale broadly, we’re innovating narrowly to start. He noted that, for this crisis, we have to design for the world as it is, not the world we want. The systems causing the greatest risk are owned and operated by entities that are target rich and cyber poor. That’s where the focus needs to be.

He also testified that heroism only takes you so far. Unless and until we examine the incentives driving behavior, we will continue to fall behind. For us at U27, this means that we’re focused specifically on bridging the education, motivation, and enablement gaps.

You can read all of Josh’s testimony (Warning! It’s a 17-page PDF… we had a lot to say!) or watch the hearing on YouTube. Let us know what you think by dropping us a line at [email protected]. Better yet, email us to come join our Slack and stop by our next town hall, Thursday, June 4, at 1:00 pm EDT. Best of all, come see us in person by registering for Critical Effect DC, in just three weeks!