Mike Sosa
Back to portfolio

Securing the Flow: Tiered Cybersecurity Policy for U.S. Water Infrastructure

  • Critical Infrastructure
  • OT/ICS Security
  • Policy & Governance
  • Red Teaming

Georgia Tech M.S. Cybersecurity capstone, 2025

The problem

Water utilities run some of the most critical systems in the country on aging technology, thin IT staff, and almost no enforceable security standards. The EPA tried to require cybersecurity reviews in 2023, but states challenged the memo in court and the EPA withdrew it that October. Utilities were left with guidance instead of requirements. Public incidents show what that costs: Oldsmar, Florida in 2021, Aliquippa, Pennsylvania in 2023, and rural Texas towns in 2024. Public reporting points to the same basics each time: remote access left exposed to the internet and weak or default passwords. (Oldsmar's cause is still disputed; the FBI couldn't confirm an outside intrusion.)

The approach

I designed a three-tier policy framework that meets utilities where they are:

  • Tier 0, essential controls: MFA for remote access, basic IT/OT segmentation, access logging, and no default credentials. These are cheap and high-impact, and every utility can implement them.
  • Tier 1, nationally feasible controls: role-based access, anomaly detection, regular penetration tests and tabletop exercises, and formal patching. Most utilities can reach these with moderate support.
  • Tier 2, locally contingent controls: physical hardening, redundant communications, and local incident response capacity. These matter most in isolated regions like Hawaii.

To ground the framework, I helped run a combined red team exercise with federal critical infrastructure experts and a Hawaii water utility, and helped uncover the vulnerabilities it found. The exercise simulated a nation-state attacker moving from open-source reconnaissance to initial access, lateral movement, and operational impact, using only low-to-moderate sophistication techniques, with no zero-days or nation-state malware. That was the point: an adversary doesn't need advanced tools to disrupt an under-protected water system. What we learned went directly into the Tier 0 and Tier 1 controls.

To prioritize, I built a Policy Viability Scoring Matrix. It scores each control across nine weighted criteria, including risk reduction, cost, legal authority, legacy compatibility, and political resistance, so decision-makers can sequence work by both impact and feasibility. I also benchmarked the framework against the energy sector (NERC CIP), pipelines (TSA security directives), and chemical facilities (CFATS, whose authority lapsed in 2023) to borrow what already works. I validated the approach through interviews with experts from the EPA, NSA, the Board of Water Supply, and DoD.

The result

I applied the matrix to the three public incidents. Basic Tier 0 and Tier 1 controls would likely have prevented or limited each attack. The analysis points to a phased roadmap: quick wins first, funded mid-term upgrades next, and legislative reform for the hardest structural gaps. The model is designed to scale, and Hawaii's isolation makes it a natural testbed.

What it shows about how I work: I turn complex technical risk into decisions leaders can fund and act on.