McCrary Institute brings together cybersecurity leaders to help prevent attacks against water plants

Auburn University's McCrary Institute for Cyber and Critical Infrastructure Security hosted a first-of-its-kind summit, Thursday, Sept. 4, aimed at protecting Alabama's water systems from the increasing threat of cyber attacks.

Like so many systems critical to the way our state and nation run, water systems often find themselves outmatched in cyberspace by ransomware gangs, cyber criminals and nation-states. The effects have very real consequences for the citizens across Alabama and the nation who rely on safe drinking water.

A 2024 EPA review found that 70% of surveyed systems failed to meet basic security standards and the cybersecurity company Fortinet revealed that one in three water utilities experienced at least one cyber incident in the last year.

Bringing together those who run the water plants with government, industry and academic leaders, the summit — held at the Auburn University Research and Innovation Campus in Huntsville — focused on helping those managing our water systems have the tools, funding and knowledge they need to protect their systems.

“Cyber threats to water systems are no longer theoretical—they are active, widespread, and growing in sophistication,” said Nick Sellers, the chief operations officer of the McCrary Institute. “Whether you’re managing a rural water system or building the networks that support them, we hope you leave today with real insight, new relationships, and a few key next steps.”

He went on to talk about the role of the McCrary Institute bringing together the cybersecurity community, federal, state, and local government leaders and those managing our state’s most critical systems.

“At Auburn University, we created the McCrary Institute for Cyber and Critical Infrastructure Security with one purpose: to defend the systems that power our national and economic security—and that includes your water systems. Today we brought together a whole host of leaders from the public and private sectors and that’s critical to not only make sure you have access to the funding and services you need, but also that we continue to build the community dedicated to protecting the citizens of Alabama and the nation.”

The event featured a keynote presentation by State of Alabama Chief Information Officer Chad Smith who walked utility leaders step-by-step through the ways they can gain visibility on what’s happening inside their systems, practical steps to take to ensure their systems are more secure and pointed towards federal funding they can take advantage of to begin or continue their cybersecurity journeys.

“We know those who are operating our state’s water systems have a lot to deal with so today, along with the McCrary Institute, we wanted to help them understand the fundamental things they can do and the many of us here to help them protect their people, preserve their reputation and secure the needed financing so they can protect their systems,” Smith said.

The group also heard from John Garstka, director for cyber warfare within the Deputy Assistant Secretary of Defense for Platform and Weapon Portfolio Management, Office of the Under Secretary of Defense for Acquisition and Sustainment, Department of Defense, who stressed the importance of the risk facing our nation’s critical systems in cyberspace.

For more information on how the McCrary Institute can provide cybersecurity services, help entities apply for federal grants or provide advice to help critical infrastructure owners and operators navigate the many cybersecurity needs and services out there, click here.

By the numbers: Cybersecurity threats to the water sector

• The U.S. operates more than 150,000 public water systems, many serving small towns and rural communities.
• A 2024 EPA review found that more than 300 systems, affecting 110 million Americans, had known cybersecurity vulnerabilities.
• In the past year, one in three water utilities experienced at least one cyber incident according to cybersecurity company Fortinet. The sector is now a prime target for both nation-state actors and criminal groups.