Small Team, Big Mandate: Water and Wastewater Cybersecurity for Utilities with Small Security Teams
Presented by Marc and Florian of Trout Software, a New York cybersecurity company for critical infrastructure, through Carahsoft. No prior security background needed; every term is explained.
Five real incidents, each broken down the same way: entry point, access method, what the attacker did, what the utility lost, and the one control that would have stopped it. Then the three things a small team can actually own: exposure, identity and evidence.
What you will learn
- Exposure: internet-facing PLCs and HMIs, flat networks, and the cellular modems at your towers, wells and lift stations that show up on the phone bill instead of the network diagram
- Identity: shared remote access, standing vendor credentials, and how to put authentication in front of a controller that has no concept of a user
- Evidence: logging that answers both the incident question and the 24-hour reporting obligation
- Manual operation as a security control: the utilities that kept serving water in Minnesota did it by hand
- The regulatory timeline: DEC wastewater reporting live March 2026, DOH operational technology requirements January 1 2027, DEC controls March 11 2027, first annual certifications March 28 2027, plus what SDWA Section 1433 and AWIA already require
Speakers
Florian Doumenc
Florian co-founded Trout Software to make Zero Trust practical for the teams running critical infrastructure. A former Google security engineer with a cybersecurity background from Harvard, he works with municipal water and wastewater operators on securing inherited OT, with the staff they have, before regulation forces the issue.
Marc Hoover
Marc is a U.S. Army Special Forces veteran whose career spans cyber, procurement, and operations management. He works with public sector teams to turn security and compliance requirements into plans they can actually execute, with the resources and timelines they have.