Ex-NSA chief: water system controllers shouldn't be on the internet after suspected Iran attacks

A former director of the U.S. National Security Agency has warned that connecting water management systems to the internet creates unacceptable risks. His remarks came amid suspicions that Iran was behind a series of cyberattacks on such facilities.

According to the expert, industrial controllers responsible for water supply were never designed to operate on open networks. Putting them online makes critical infrastructure vulnerable to remote hacking, which could disrupt water service in entire cities or lead to even more severe consequences.

The attacks linked to Iran have shown that malicious actors actively scan the internet for unprotected devices. Several U.S. facilities were affected, though the scale of the damage has not been disclosed. Specialists stress that such systems should be isolated from the global network, with access granted only through secure channels.

The former NSA chief also noted that the problem is compounded by aging infrastructure: many controllers have been in service for decades and receive no security updates. Under these conditions, even basic measures like changing default passwords and network segmentation could significantly reduce risks.

The situation is particularly concerning because water supply is a critical lifeline. Experts urge utility operators to rethink their approach to cybersecurity and treat any internet connection as a potential threat. Otherwise, the consequences of the next attacks could be far more severe.