Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks
Jump to main content
Search
REG AD
Security
Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks
Calling all defenders
Jessica Lyons
Jessica<br>Lyons
Cybersecurity Editor
Published<br>fri 7 Aug 2026 // 20:53 UTC
With at least 12 US states’ water systems having been hacked - most likely by Iran - we have to get better at cyber defense, according to retired General and Ex-NSA chief Paul Nakasone, who was speaking to reporters at DEF CON.<br>“We have to have higher standards,” Nakasone said. “These PLCs should not be connected to the internet.”<br>In late July, the FBI said it was investigating attacks conducted by “malicious cyber actors” targeting operational technology devices, including programmable logic controllers (PLCs). Iran-linked crews have targeted these devices, which monitor sensor data like tank levels, and can turn pumps on and off, for years.
REG AD
REG AD
Some private-sector security researchers say that they suspect Iranian intruders are behind the recent cyberattacks disrupting water and wastewater facilities. “I'd be shocked if it's not Iran,” Halcyon Ransomware Research Center SVP Cynthia Kaiser told The Register at DEF CON on Friday. “It's almost certain it's Iran.”<br>Neither the FBI nor anyone in the Trump administration, however, has officially blamed Iran.<br>Nakasone said he believes that the feds are “taking a measured approach” to attribution. “But I see an actor here that has certainly shown a history of being able to do this,” he added, referring to earlier Iranian cyberattacks targeting water facilities’ PLCs.<br>“They certainly have the capability,” Nakasone said. “There's an intent … we're in conflict with Iran.”<br>US water systems present a massive attack surface across disparate facilities that are historically underfunded and have limited IT staff, and sometimes no dedicated cybersecurity employees.<br>“We have to think differently about how we defend it,” Nakasone said. “Let's talk about the attack surface that we're looking at right now. We’ve got 50,000 different water municipalities in the United States, 90 percent of our water comes from these 50,000.”<br>Defending these water systems requires partnerships, he added, pointing to DEF CON Franklin, a project launched two years ago at the annual event with hackers volunteering their time and talent to help secure water facilities.<br>Nakasone also serves as founding director of Vanderbilt University’s Institute of National Security, and its Wicked Problems Lab. He's also working on Project Chimera, a cybersecurity platform being developed by academics and cybersecurity practitioners, and built on open-source technologies to boost critical infrastructure resilience.
REG AD
“How do you defend better? You defend with a series of partners, in a much more involved approach than we have right now,” Nakasone said.®
cyber-crime<br>iot<br>security<br>iran
REG AD
Security
Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks
Calling all defenders
AI and ML
AI titans to tidy agent frontier with plugin prescription
Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms
devops
Platform Engineering 2.0: your platform was built for a different era. AI just exposed it
PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era.
security
Ransomware attacks spike as world distracted by AI
What, you didn't think the top gangs were busy watching agents escape their sandboxes too, did you?
COLUMNISTS
Adding an API to networking hardware doesn’t solve management challenges
This is why cloud-inspired networks win: virtual switches are all consistent
SCIENCE
Brit boffins boast of beating barriers to building fusion power
MAST Upgrade installation hit highest pressure ever achieved without the super-hot plasma destabilizing
MOST POPULAR
SECURITY
IT department put sticky notes on the laptops to help employees log in
AI and ML
AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon
Security
London cops handed victim's new address and number to her stalker, watchdog says
saas
Double trouble for Microsoft as pre-owned software license claims converge
AI AND ML
Microsoft tells engineers to curb their token-burning enthusiasm
AI
AI and ML
AI titans to tidy agent frontier with plugin prescription
Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms
AI and ML
How the famed USENIX Security conf is managing a flood of papers in the AI era
AI usage is evident but isn't yet a serious problem
AI and ML
AMD acquires AI chip startup Taalas to boost inference performance by etching models into silicon
Early tech demos...