Water system controllers don't belong on the internet, says ex-NSA chief

At DEF CON, former NSA chief Paul Nakasone said that programmable logic controllers (PLCs) used in water systems "should not be connected to the internet," and that "we have to have higher standards" for cyber defense. His remarks come after the FBI confirmed it was investigating attacks on operational technology devices, including PLCs, that monitor sensor data and control pumps at water facilities, with at least 12 US states affected. Iran-linked groups are widely suspected: private-sector researcher Cynthia Kaiser said, "I'd be shocked if it's not Iran," though no official attribution has been made.

Nakasone acknowledged the federal government's "measured approach" to attribution but noted the attacker's history and capability: "There's an intent … we're in conflict with Iran." He highlighted the enormous attack surface of US water infrastructure—50,000 different municipalities supplying 90% of the nation's water—often underfunded with limited or no dedicated cybersecurity staff. To defend these systems, he argued for a different approach involving partnerships.

Existing efforts include DEF CON Franklin, a project launched two years ago where hackers volunteer to secure water facilities. Nakasone also mentioned Project Chimera, a cybersecurity platform built on open-source technologies by academics and practitioners to boost critical infrastructure resilience. "How do you defend better? You defend with a series of partners, in a much more involved approach than we have right now," he said.