Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks

General and Former NSA chief Paul Nakasone has warned that water system controllers should not be connected to the internet, following a series of suspected cyber attacks linked to Iran. This warning comes after at least 12 US states' water systems were hacked, most likely by Iran, according to Nakasone, who spoke at DEF CON. The FBI is currently investigating these attacks, which involve malicious cyber actors targeting operational technology devices such as programmable logic controllers (PLCs), which monitor and control sensor data like tank levels and can turn pumps on and off.

While the FBI and the Trump administration have not officially blamed Iran for these attacks, cybersecurity researchers strongly suspect that Iranian intruders are responsible. Nakasone believes that the US government is taking a cautious approach to attributing these attacks but sees a clear threat from a historically capable adversary with intent towards conflict.

US water systems, he points out, present a significant attack surface due to the large number of disparate facilities that are historically underfunded and have limited IT staff, often lacking dedicated cybersecurity employees. To improve defense, Nakasone advocates for a more collaborative approach involving key partners and a series of initiatives like DEF CON Franklin, Project Chimera, and others to better secure critical infrastructure.