Cascading Failure, Unified Defense: Defending Water, Power, Healthcare, & EMS

The talk opens with a walk-through of a cardiac patient in an ambulance whose route to the nearest hospital is diverted after a water utility is hit by a cyberattack. Hospitals lose water pressure, sterilization, dialysis and cooling, and the golden hour slips away. The speakers, who draw on first-responder and security experience, frame this as a chain where a weak link in one utility can disable care far from the original target.

Next they describe state-linked groups such as Volt Typhoon and Salt Typhoon, which they say persist for years by abusing edge devices like VPNs and firewalls, blending traffic into legitimate cloud services, and rotating command channels. They also cover how dispatch centers can fall back to paper maps when geocoding fails, and why legacy OT systems that cannot be patched are hard to retire.

The closing section gives practical guidance: prioritize patching internet-facing devices using CISA's KEV list, enforce MFA, segment IT from OT, centralize logs, and test restores. It also recommends joint playbooks that merge cyber and emergency-management plans, regional mutual aid, cross-training through free courses, sector ISACs, and community steps such as CPR training and volunteering.