Protecting a water utility's networks in real time.

The challenge

SCWD's security team identified these key challenges:

• Limited real-time threat intelligence. Legacy systems did not update dynamically to block new threats, which left gaps.
• Manual processes. Updating firewall rules and responding to incidents took significant time and effort from a small IT team.
• Remote workers. Staff working remotely or on mobile devices needed the same protection outside the network perimeter.
• Compliance and visibility. SCWD needed threat data in its SIEM for compliance reporting and day-to-day operations.
• Scale without complexity. The solution had to fit the existing infrastructure and grow without adding operational overhead.

What ThreatSTOP did

SCWD deployed five ThreatSTOP services, each aimed at one part of the problem:

• IP Defense blocks malicious IP addresses at the network layer using ThreatSTOP's real-time threat intelligence. It runs on SCWD's existing firewalls, with granular policies that protect both the OT and IT networks and keep them segmented.
• DNS Defense blocks malicious domains and command-and-control traffic at the DNS layer, using blocklists tuned for threats to water utilities, such as ransomware aimed at SCADA systems.
• Roaming Defense extends the same IP and DNS blocklists to remote and mobile devices through a lightweight agent, so policy is the same on and off site.
• SIEM integration brings threat and incident data into SCWD's SIEM for central visibility, faster incident analysis and automated compliance reporting.
• API access lets SCWD query ThreatSTOP's threat intelligence for custom integrations and threat hunting, and automate parts of its response.

How the rollout went

ThreatSTOP's implementation team mapped SCWD's network and critical assets, such as SCADA systems and billing servers, tailored blocklists to threats relevant to the water sector, connected ThreatSTOP to the existing firewalls, DNS servers and SIEM without disrupting operations, trained SCWD's IT team, and validated the setup by simulating attacks. Because ThreatSTOP is cloud based, no new hardware was needed, and the whole deployment took under two weeks.

The result

• Thousands of malicious domains and IPs blocked every month, keeping ransomware, phishing and command-and-control traffic away from critical systems.
• A 40% reduction in mean time to detect and respond, and fewer manual rule updates for the IT team.
• Stronger policy enforcement and segmentation across the OT and IT networks.
• Remote staff protected to the same level as people on site.
• Threat data in the SIEM, with reporting that supports EPA cybersecurity requirements and America's Water Infrastructure Act (AWIA).

What is next

SCWD plans to bring ThreatSTOP into new SCADA and IoT deployments, use API access for more automated incident response, and share what it has learned with other water utilities.