Water system controllers don't belong on the internet, says ex-NSA chief Security Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks Calling all def
By Coderz Club · 2026-08-08 · Tags: coding
Water system controllers don't belong on the internet, says ex-NSA chief
Security Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks Calling all defenders Jessica Lyons Jessica Lyons Cybersecurity Editor Published fri 7 Aug 2026 // 20:53 UTC With at least 12 US states’ water systems having been hacked - most likely by Iran - we have to get better at cyber defense, according to retired General and Ex-NSA chief Paul Nakasone, who was speaking to reporters at DEF CON.“We have to have higher standards,” Nakasone said. “These PLCs should not be connected to the internet.”In late July, the FBI said it was investigating attacks conducted by “malicious cyber actors” targeting operational technology devices, including programmable logic controllers (PLCs). Iran-linked crews have targeted these devices, which monitor sensor data like tank levels, and can turn pumps on and off, for years. REG AD REG AD Some private-sector security researchers say that they suspect Iranian intruders are behind the recent cyberattacks disrupting water and wastewater facilities. “I'd be shocked if it's not Iran,” Halcyon Ransomware Research Center SVP Cynthia Kaiser told The Register at DEF CON on Friday. “It's almost certain it's Iran.”Neither the FBI nor anyone in the Trump administration, however, has officially blamed Iran.Nakasone said he believes that the feds are “taking a measured approach” to attribution. “But I see an actor here that has certainly shown a history of being able to do this,” he added, referring to earlier Iranian cyberattacks targeting water facilities’ PLCs. “They certainly have the capability,” Nakasone said. “There's an intent … we're in conflict with Iran.”US water systems present a massive attack surface across disparate facilities that are historically underfunded and have limited IT staff, and sometimes no dedicated cybersecurity employees.“We have to think differently about how we defend it,” Nakasone said. “Let's talk about the attack surface that we're looking at right now. We’ve got 50,000 different water municipalities in the United States, 90 percent of our water comes from these 50,000.”Defending these water systems requires partnerships, he added, pointing to DEF CON Franklin, a project launched two years ago at the annual event with hackers volunteering their time and talent to help secure water facilities.Nakasone also serves as founding director of Vanderbilt University’s Institute of National Security, and its Wicked Problems Lab. He's also working on Project Chimera, a cybersecurity platform being developed by academics and cybersecurity practitioners, and built on open-source technologies to boost critical infrastructure resilience. REG AD “How do you defend better? You defend with a series of partners, in a much more involved approach than we have right now,” Nakasone said.® cyber-crime iot security iran REG AD AI and ML OpenAI pledges to add Astra security as Anthropic loosens Fable's leash Or how I learned to stop worrying and love dangerous AI Security Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks Calling all defenders devops Platform Engineering 2.0: your platform was built for a different era. AI just exposed it PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era. AI and ML AI titans to tidy agent frontier with plugin prescription Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms COLUMNISTS Adding an API to networking hardware doesn’t solve management challenges This is why cloud-inspired networks win: virtual switches are all consistent security Ransomware attacks spike as world distracted by AI What, you didn't think the top gangs were busy watching agents escape their sandboxes too, did you? MOST POPULAR SECURITY IT department put sticky notes on the laptops to help employees log in AI and ML AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon Security London cops handed victim's new address and number to her stalker, watchdog says saas Double trouble for Microsoft as pre-owned software license claims converge AI AND ML Microsoft tells engineers to curb their token-burning enthusiasm AI AI and ML OpenAI pledges to add Astra security as Anthropic loosens Fable's leash Or how I learned to stop worrying and love dangerous AI AI and ML AI titans to tidy agent frontier with plugin prescription Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms AI and ML How the famed USENIX Security conf is managing a flood of papers in the AI era AI usage is evident but isn't yet a serious problem AI and ML AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon Early tech demos show model-specific integrated ci
Security Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks Calling all defenders Jessica Lyons Jessica Lyons Cybersecurity Editor Published fri 7 Aug 2026 // 20:53 UTC With at least 12 US states’ water systems having been hacked - most likely by Iran - we have to get better at cyber defense, according to retired General and Ex-NSA chief Paul Nakasone, who was speaking to reporters at DEF CON.“We have to have higher standards,” Nakasone said. “These PLCs should not be connected to the internet.”In late July, the FBI said it was investigating attacks conducted by “malicious cyber actors” targeting operational technology devices, including programmable logic controllers (PLCs). Iran-linked crews have targeted these devices, which monitor sensor data like tank levels, and can turn pumps on and off, for years. REG AD REG AD Some private-sector security researchers say that they suspect Iranian intruders are behind the recent cyberattacks disrupting water and wastewater facilities. “I'd be shocked if it's not Iran,” Halcyon Ransomware Research Center SVP Cynthia Kaiser told The Register at DEF CON on Friday. “It's almost certain it's Iran.”Neither the FBI nor anyone in the Trump administration, however, has officially blamed Iran.Nakasone said he believes that the feds are “taking a measured approach” to attribution. “But I see an actor here that has certainly shown a history of being able to do this,” he added, referring to earlier Iranian cyberattacks targeting water facilities’ PLCs. “They certainly have the capability,” Nakasone said. “There's an intent … we're in conflict with Iran.”US water systems present a massive attack surface across disparate facilities that are historically underfunded and have limited IT staff, and sometimes no dedicated cybersecurity employees.“We have to think differently about how we defend it,” Nakasone said. “Let's talk about the attack surface that we're looking at right now. We’ve got 50,000 different water municipalities in the United States, 90 percent of our water comes from these 50,000.”Defending these water systems requires partnerships, he added, pointing to DEF CON Franklin, a project launched two years ago at the annual event with hackers volunteering their time and talent to help secure water facilities.Nakasone also serves as founding director of Vanderbilt University’s Institute of National Security, and its Wicked Problems Lab. He's also working on Project Chimera, a cybersecurity platform being developed by academics and cybersecurity practitioners, and built on open-source technologies to boost critical infrastructure resilience. REG AD “How do you defend better? You defend with a series of partners, in a much more involved approach than we have right now,” Nakasone said.® cyber-crime iot security iran REG AD AI and ML OpenAI pledges to add Astra security as Anthropic loosens Fable's leash Or how I learned to stop worrying and love dangerous AI Security Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks Calling all defenders devops Platform Engineering 2.0: your platform was built for a different era. AI just exposed it PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era. AI and ML AI titans to tidy agent frontier with plugin prescription Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms COLUMNISTS Adding an API to networking hardware doesn’t solve management challenges This is why cloud-inspired networks win: virtual switches are all consistent security Ransomware attacks spike as world distracted by AI What, you didn't think the top gangs were busy watching agents escape their sandboxes too, did you? MOST POPULAR SECURITY IT department put sticky notes on the laptops to help employees log in AI and ML AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon Security London cops handed victim's new address and number to her stalker, watchdog says saas Double trouble for Microsoft as pre-owned software license claims converge AI AND ML Microsoft tells engineers to curb their token-burning enthusiasm AI AI and ML OpenAI pledges to add Astra security as Anthropic loosens Fable's leash Or how I learned to stop worrying and love dangerous AI AI and ML AI titans to tidy agent frontier with plugin prescription Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms AI and ML How the famed USENIX Security conf is managing a flood of papers in the AI era AI usage is evident but isn't yet a serious problem AI and ML AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon Early tech demos show model-specific integrated ci