Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Blood in the Water: Preparing For the Feeding Frenzy

Dean Ford

ICS / OTI Am The Cavalry55 minBeginnerOpen on YouTube ↗

Where

I Am The Cavalry
BSides Las Vegas

Duration

55 min

Explores how water utilities face cyber-physical risk, cascading outages and supply chain strain from state-linked attacks.

Summary

Dean Ford, an automation engineer and professional engineer who works on operational technology, opens by framing the water sector as a set of local, loosely connected utilities. He describes patchwork databases, aging pipes and older control equipment, and cites recent documented intrusions into US water systems as a reason for concern.

The middle of the talk becomes a walk through cascading failure. Starting from a simple hotel power outage, the audience works through what breaks next, from air conditioning and elevators to refrigerated medicine and evacuation. The same chain is then applied to a compromised pump controller. Long replacement lead times, thin spare inventories and reliance on a single vendor turn one device fault into a supply problem. A hypothetical water hammer, caused by manipulated pumps or valves, shows how brittle pipes can fail across a network, and the loss of pressure then reaches hospitals, fire protection, airports and data centers.

The closing argues that a proposed sanitary-style cyber assessment was rejected, that utilities are underfunded, and that insurance and single-product purchases can give false comfort. Practical takeaways include knowing where your water comes from and how old the pipes are, planning around outage duration, keeping critical spares, diversifying vendors, and attending local utility meetings. He also stresses that the skills needed to run these systems are more than one person can hold.

Related talks