After hackers targeted water utilities across the country late last month, the board of directors for Alabama’s largest water utility hired a Michigan-based IT company on Monday to help with its cybersecurity efforts.
Central Alabama Water’s contract with IT services company Element Four doesn’t come with a price tag, which some board members questioned and CEO Jeffrey Thompson answered by pointing to recent events.
“So, is there a rush?” board member Jarvis Patton Sr. asked.
“There is, and that is due to the nature of the world in which we live right now, in terms of the cybersecurity threats that we face,” Thompson said. “As we have seen in the news, security – IT and cybersecurity – is incredibly important.”
Thompson said while the agreement the board approved doesn’t lay out exactly how much CAW will pay Element Four, he doesn’t expect costs to exceed the utility’s IT budget. If that were to happen, the issue would come back before the board, he said.
Cameron Holly, chief technology officer for CAW, said the utility has already been working with Element Four, but without a contract.
“It's to our benefit for security purposes to align with a variety of partners who can help strengthen that in every way possible,” Holly said. “So it's just one more piece of ammunition in our arsenal.”
At the end of the meeting, the board and senior managers entered an executive session, which was closed to the public and media. Security matters were a topic they planned to discuss, and Holly said he would need five to 10 minutes to brief the board.
Travis Atkison, director of the cybersecurity program at the University of Alabama, said partially outsourcing cybersecurity efforts is a common practice across critical infrastructure sectors. Most organizations don't have the in-house expertise or headcount to keep pace with threats, so they bring in specialized security vendors who focus on those things full time.
“In many cases, these vendors can secure the environment more effectively than an in-house team would be able to on its own,” Atkinson said.
This deeper security expertise can be a tradeoff, though, because giving any external entity remote access could create opportunities for hackers, he continued.
Reputable vendors use secure remote-access methods that don't meaningfully increase risk, he said, and utilities are accountable for vetting companies they trust with that access.
Financially stressed utilities are at higher risk for cyberattacks because they have fewer resources to combat them, Atkison said. CAW drastically cut its budget and staff earlier this year.
CAW spokesman John Matson said the utility has to walk a fine line when deciding what information it releases publicly about its cybersecurity program.
“We don't need to say something that might give a hacker a clue,” Matson said. “The other thing is, you don't want to say anything that would make a hacker say, 'OK, challenge accepted,’ and then target you like that.”
He said cybersecurity is a top priority for CAW, and the utility follows industry best practices.
Board retains attorney to oversee legal affairs
Also at Monday’s meeting, the board created a general legal counsel position and named one of the three external attorneys it regularly works with to fill that role.
Shan Paden will not be a CAW employee, and he said the utility will continue paying him on an hourly basis. According to a CAW press release, his work will involve providing legal advice and representation on matters affecting the utility’s governance and operations as well as coordinating litigation involving CAW and overseeing corporate compliance.
The water utility is facing a plethora of lawsuits, including at least three related to the state of Alabama restructuring the utility and its board last year.
Paden said his new role is an expansion of his previous one.
“So now I’m going to oversee everyone's legal work,” he said. “They wanted somebody to be in charge of the legal affairs.”
The board in July appointed Paden to be CAW’s secretary, and he will continue in that role.
Paden has twice served as attorney for the city of Bessemer and is currently an attorney for Bessemer Electric and Water Service and the Bessemer Industrial Development Board.
