Annapolis, MD – Maryland is bolstering its defenses against increasingly sophisticated cyberattacks through a novel approach: collaborative training exercises and information sharing between state National Guard units, federal agencies, and private sector critical infrastructure operators. The effort, focused initially on protecting the state’s water and wastewater systems, reflects a growing national concern about the vulnerability of essential services to digital threats. This proactive stance on cybersecurity is becoming increasingly vital as malicious actors target essential services, seeking to disrupt daily life and potentially compromise national security.
A recent workshop hosted by the Maryland National Guard, in partnership with leaders in the water and wastewater industry and officials from the Department of War (DOW), marked a first-of-its-kind collaboration. According to Maryland National Guard officials, it was the first time the DOW had directly teamed up with a state National Guard for a cybersecurity workshop of this nature. The gathering aimed to enhance the cyber resilience of these vital systems, strengthen relationships, and establish a unified approach aligned with the National Governors Association’s State-Federal Unity of Effort on Cybersecurity framework.
Bridging the Lexicon Gap: The Importance of Shared Understanding
The need for such collaboration stems from a fundamental challenge: differing terminology and approaches across sectors. Colonel Roger Koehler, commander of the 175th Cyberspace Operations Group, emphasized the importance of clear communication. “We all have our own lexicon,” Koehler explained. “Just between the Army and the Air Force, we have different lexicons a lot of times when it comes to cyber. Then, you start working with state organizations, and they have different lexicons. You start working with industry, and they have different lexicons. And I consider getting around the table and kind of talking through [this], you realize a lot of the times that people have different ideas in their mind of the problem they’re going after, and really laying all that out helps improve what you’re trying to accomplish.”
This “lexicon gap” extends beyond terminology. Different organizations may prioritize different aspects of cybersecurity, leading to misaligned strategies. Koehler highlighted the distinction between critical infrastructure and defense critical infrastructure, noting that a shared understanding of these nuances is crucial for effective preparation. The Maryland National Guard’s efforts aim to bridge these gaps, fostering a common operating picture and ensuring a coordinated response in the event of a cyber incident.
Sharpening Skills Through Competition: The Capture the Flag Exercise
Beyond workshops, the Maryland Air National Guard is actively honing its cyber skills through hands-on training. Late last year, the 175th Cyberspace Operations Group hosted its first wing-wide “capture the flag” (CTF) competition. Air Force officials reported that the event involved both airmen and soldiers from the Maryland Army National Guard Cyber Protection Team. Participants were divided into teams and tasked with identifying vulnerabilities within a simulated network environment.
The CTF exercise wasn’t limited to seasoned cybersecurity professionals. It was designed to accommodate individuals of all skill levels, from beginners to experienced operators. Teams earned points by discovering hidden code, passwords, web applications, and documents – the “flags” – which provided clues to subsequent challenges. This approach not only enhanced technical skills but also fostered a deeper understanding of cyber operations and the evolving threat landscape. The exercise provided a practical, competitive environment to test and refine defensive and offensive cybersecurity techniques.
The Growing Threat to Water and Wastewater Systems
The focus on water and wastewater systems is particularly timely. These systems, often overlooked, are increasingly targeted by cyberattacks. A successful attack could disrupt water supplies, compromise water quality, or even cause physical damage to infrastructure. The Environmental Protection Agency (EPA) has issued guidance and resources to help water and wastewater utilities strengthen their cybersecurity posture, recognizing the critical nature of these services. The EPA’s Water Security Division provides information on risk assessments, incident response, and best practices for cybersecurity.
The Maryland initiative aligns with a broader national effort to improve critical infrastructure cybersecurity. The Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security plays a central role in coordinating these efforts, providing resources and support to state and local governments, as well as private sector organizations. CISA’s critical infrastructure sectors page details the agency’s focus areas and provides access to threat advisories and security guidance.
These exercises and workshops aren’t simply about technical skills. they’re about building relationships and fostering a proactive cybersecurity culture. As Colonel Koehler emphasized, the goal is to be prepared for potential missions, both at the state and federal levels. The Maryland National Guard’s approach demonstrates a commitment to collaboration and a recognition that defending against cyber threats requires a unified effort.
Looking ahead, the Maryland National Guard plans to continue these collaborative exercises and expand their scope to include other critical infrastructure sectors. The next scheduled workshop, planned for early next year, will focus on the energy sector, bringing together stakeholders from utilities, government agencies, and the private sector. Updates on these initiatives will be posted on the Maryland National Guard News website.
This ongoing commitment to cybersecurity collaboration is essential for protecting Maryland’s vital infrastructure and ensuring the safety and well-being of its citizens. Share your thoughts on the importance of cybersecurity preparedness in the comments below.
Worth a look
