Small Utility
Cyber Defense Kit.

The single biggest upgrade available to you. Dragos gives water, electric, and gas utilities in the US and Canada — under $100M annual revenue — free access to its professional OT security platform: asset inventory, threat detection, and vulnerability management for your SCADA/plant network, plus membership in Neighborhood Keeper (anonymized collective threat visibility across utilities) and OT-CERT (free playbooks, guides, and working sessions). Utilities your size could never buy this; through this program you get it at no cost.

1. Confirm eligibility: you are a US or Canada water, electric, or natural gas provider, and neither you nor any parent company exceeds $100M US in annual revenue.
2. Apply at dragos.com/community/community-defense-program. Have basic facts ready: service population, number of facilities, rough count of PLCs/HMIs, and who manages your network.
3. When accepted, Dragos will walk you through deploying their sensor on a mirrored port of your OT network switch (see the SPAN port sidebar in Tier 3 — same concept). The sensor only listens; it cannot affect operations.
4. Join OT-CERT (dragos.com/community/ot-cert) immediately even while the application is pending — the resource library alone is worth it.

Contact: application form on the Dragos site · If accepted, this program covers most of Tier 3 for your OT network automatically.

The US government will continuously scan your public-facing internet addresses and send you a weekly report of every exposed service and known vulnerability — the same view an attacker gets, delivered to your inbox first. Zero effort after enrollment.

1. Email vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services". Say you are a water/electric utility (critical infrastructure — you qualify).
2. CISA replies with a service request form and an acceptance letter. Fill them in and list your public IP addresses (your ISP bill or router WAN status page shows these; your internet provider can confirm the full range).
3. Scanning typically begins within 3 business days of completed paperwork; your first report arrives within about two weeks, then weekly.
4. Treat every "Critical" or "High" finding in the weekly report as a work order. If a finding mentions a SCADA, HMI, or VPN product — drop everything and fix it that day.

Contact: vulnerability@cisa.dhs.gov · details at cisa.gov/cyber-hygiene-services

This is how small utilities actually get breached. One afternoon of unglamorous work removes the attack path used in almost every publicized water-sector incident, including Aliquippa.

1. Inventory every way in. On a whiteboard, list every method anyone — staff, SCADA integrator, pump vendor, billing software support — uses to reach your systems from outside: TeamViewer, AnyDesk, VNC, Windows Remote Desktop, vendor modems, port forwards on the firewall. Ask your integrator directly: "How do you connect to our system when we call you?"
2. Check the firewall/router for port forwards. In your firewall admin page, list all port-forwarding / NAT rules. Any rule pointing at an HMI, PLC, historian, or camera DVR gets removed today. Legitimate needs get rebuilt properly in Tier 2 (Tailscale).
3. Change every default password. PLCs, HMIs, the firewall itself, managed switches, VFDs with web pages, camera systems. If the password is 1111, admin, password, or the vendor's name — change it now and record the new one in your password manager (per the VCRI Starter Kit). The Aliquippa controller was defaced through the factory default 1111.
4. Disable what nobody claims. Any remote-access tool no one can explain gets uninstalled. If it turns out someone needed it, they'll call — and then you'll rebuild their access the right way.
5. Turn on MFA everywhere it exists: email, VPN, TeamViewer/AnyDesk accounts that survive the audit, cloud billing, bank.

Tip: photograph the whiteboard — that inventory is the seed of your asset list and your Tier 2 rebuild.

Shodan is the search engine attackers use to find exposed industrial systems. A one-time membership lets you put a standing watch on your own addresses: the day something of yours shows up on the internet, you get an email. It complements the CISA scan — different eyes, instant alerts.

1. Create an account at shodan.io and buy the one-time membership (~$49; watch for their frequent $5 sales).
2. Go to monitor.shodan.io, add your public IP range from the CISA paperwork, and enable all alert types.
3. While you're there, search Shodan for your utility's name and your town — confirm nothing of yours is already listed. If it is, that device goes to the top of today's list.

Contact: monitor.shodan.io · alerts arrive by email — route them to two people, not one.

Replaces every port forward and consumer remote-desktop tool you removed in Tier 1. Tailscale builds an encrypted private network between enrolled devices — nothing is exposed to the public internet, every connection is tied to an identity with MFA, and you can grant your SCADA integrator access to exactly one machine instead of your whole network.

1. Create an account at tailscale.com (free tier: 3 users, 100 devices — typically plenty; the paid tier is modest if you outgrow it). Use your utility email with MFA enabled.
2. Install Tailscale on the machines staff genuinely need to reach remotely — typically the office PC and the SCADA viewing workstation. Prefer per-machine installs over subnet routing; never route the OT subnet broadly.
3. Install it on staff laptops/phones that need access. Each device must be approved by the admin before it can connect.
4. For your integrator: enable Tailscale's sharing/ACL features to grant their account access to only the specific machine they service, and turn their access off when the service call ends. Access on demand, not standing.
5. Reboot the firewall config: with Tailscale in place, there should be zero inbound port forwards. Verify next week's CISA report shows nothing listening.

Alternative: if policy requires self-hosted, WireGuard on the firewall achieves the same — more setup, no third party.

Utilities that survive ransomware are the ones with tested, offline backups. Veeam's free edition covers 10 machines — enough for the SCADA historian, engineering workstation, HMI server, billing, and office systems at most small utilities.

1. Download Veeam Backup & Replication Community Edition from veeam.com. Install on a dedicated PC or VM — not on a machine you're backing up.
2. Back up, in priority order: engineering workstation (your PLC project files live here — losing them can mean weeks of downtime), SCADA/HMI server, historian, billing server, domain controller if you have one.
3. Follow 3-2-1: three copies, two media, one offline. The offline copy can be as simple as two USB drives rotated weekly, with the off-rotation drive unplugged and in a drawer (or better, offsite). Ransomware cannot encrypt a drive that isn't connected.
4. Also export PLC/RTU programs and configs from your engineering software to the backed-up folder — ask your integrator to help the first time. This is the step almost everyone misses.
5. Put a monthly 30-minute event on the calendar: restore one file and boot one machine's backup. An untested backup is a hope, not a plan. Log each test — your insurer and auditors will love you.

Contact: veeam.com · Community Edition is permanent, not a trial.

CISA scans you from outside; this scans from inside. The free tier covers 16 addresses — usually enough for a small utility's office network: PCs, servers, firewall, printers.

1. Register for Nessus Essentials at tenable.com and install it on an office PC or VM.
2. Scan your office/IT network only. Never point an active scanner at the OT/SCADA network — older PLCs can crash or fault when actively probed. OT visibility comes passively, from Dragos CDP or the Tier 3 sensor box.
3. Run monthly. Work the Critical findings first; most fixes are "install the update" or "turn off the unused service."

Alternative: Greenbone/OpenVAS is free with no IP limit — more setup effort.

Two hours in a conference room walking through "the SCADA screens just went dark" — often the first time operations, IT, and management have ever talked through the same emergency. CISA publishes ready-made exercise packages (CTEPs), including water-sector and ICS scenarios, with facilitator scripts included.

1. Download a CISA Tabletop Exercise Package from cisa.gov — pick the water or industrial-control ransomware scenario.
2. Invite the GM, lead operator, whoever does IT, and your SCADA integrator (they'll usually attend free — you're their client). A volunteer or your regional CISA advisor can facilitate.
3. Walk the scenario. Capture every "wait, who calls whom?" and "where IS that number?" — those gaps are the deliverable.
4. Write the one-page result: who declares an incident, who can run the plant manually and for how long, who calls CISA (report@cisa.gov / 1-844-SAY-CISA), the state, your insurer, and WaterISAC. Print it. Tape it inside the control-room cabinet. The plan must survive the network being down.

Contact: your regional CISA Cybersecurity Advisor (below) will often facilitate at no cost.

When utilities like yours are being targeted, these are the people who tell you before it's news — in plain language, with what to do about it.

1. Water: join WaterISAC (discounted small-system tiers) and take EPA's free cybersecurity technical assistance and evaluation at epa.gov/waterresilience. The AWWA small-systems cybersecurity guidance pairs well with both.
2. Electric: join E-ISAC (no cost for utilities) and ask your co-op association or joint action agency about shared cyber programs — many now have them.
3. Both: email your regional CISA Cybersecurity Advisor (find yours via cisa.gov/about/regions) and introduce yourself. Free on-site assessments, exercise facilitation, and a human who answers when you call during an incident.

During an incident: report@cisa.gov · 1-844-SAY-CISA · plus your ISAC and state primacy/PUC contacts.

One quiet industrial PC, plugged into a mirror port on your network switch, running free government-built and open-source software. It listens to a copy of your traffic — it cannot touch operations — and gives you: an automatic asset inventory, intrusion detection, full network visibility with ICS protocol awareness, and log collection with alerting from your Windows machines. This is the same architecture commercial products charge five figures a year for.

 INTERNET ── FIREWALL ── CORE SWITCH ────────── office PCs, servers
                             │ ▒ SPAN/mirror port (copy of traffic)
                             ▼
                       ┌───────────────┐
                       │  SENSOR BOX   │  NIC 1: sniffing (no IP address)
                       │  Malcolm      │  NIC 2: management (view dashboards)
                       │  + Wazuh      │
                       └───────────────┘
                             ▲
                             │ ▒ second SPAN from OT switch — ONLY if
             OT SWITCH ──────┘   not already covered by a Dragos sensor

Hardware (~$800–1,500): a fanless industrial mini-PC or small server with 8+ CPU cores, 32 GB RAM (64 GB if budget allows), a 1–2 TB SSD, and at least two Ethernet ports (four is better). Refurbished business servers work fine; fanless matters only if it lives in a dusty plant room instead of the office.

1. Configure a SPAN/mirror port on your main switch: log into the switch admin page and set one port to mirror all traffic (most managed switches — UniFi, Cisco, Netgear — support this; your integrator can do it in 15 minutes). Cable it to the box's sniffing NIC.
2. Install Malcolm (github.com/cisagov/Malcolm) — CISA's free network-analysis suite, built with Idaho National Laboratory specifically for environments like yours. Install Ubuntu Server LTS, install Docker, clone the repo, run ./scripts/configure (accept defaults; set the capture interface to the sniffing NIC), then ./scripts/start. One package gives you Zeek (traffic analysis with ICS/SCADA protocol parsers — it understands Modbus and DNP3), Suricata (intrusion detection), Arkime (full packet search), NetBox (asset inventory that populates itself), and OpenSearch dashboards.
3. Install Wazuh (wazuh.com) on the same box or a small VM — free SIEM/endpoint monitoring. Run the server install script, then deploy the Wazuh agent to your Windows machines (HMI server, historian, engineering workstation, office PCs). Out of the box it alerts on failed logins, new admin accounts, service changes, and ransomware-like file activity.
4. Baseline week: let it run for a week, then have your volunteer review the NetBox inventory with your lead operator. Expect surprises — "what is that IP?" is the whole point. Every device gets named or investigated.
5. Weekly ritual (30 min, calendared): new devices in NetBox since last week? Top Suricata alerts? Wazuh authentication failures? Any OT-protocol traffic from an unexpected source? Screenshot the dashboard into a running log — that trail is gold for insurers, auditors, and any future incident.

Optional add-on: runZero Community Edition (free tier) for gentler, richer asset discovery on the office network — it's designed to be safe around fragile devices, but keep even it off the OT segment unless your integrator supervises.