An ex-NSA chief has warned that water system controllers should not be connected to the internet, according to reporting from The Register. The statement comes in response to suspected cyberattacks attributed to Iran.
The expert’s position reflects longstanding concerns in cybersecurity circles about the risks of connecting critical infrastructure to networked systems. Water treatment facilities and their control systems manage essential public resources, and unauthorized access could pose serious risks to public health and safety.
Iranian cyber operations have been a subject of significant concern for U.S. cybersecurity officials. The Register reported on suspected Iranian attacks, though specific details about the scope or impact of these particular incidents were not provided in the available source material.
The recommendation to keep water system controllers offline aligns with broader discussions in the cybersecurity and critical infrastructure communities about which systems genuinely require internet connectivity and which should remain air-gapped or isolated from networks. Proponents of this approach argue that removing internet access eliminates entire classes of remote attack vectors.
This statement underscores the tension between operational efficiency and security. While networked systems offer advantages in remote monitoring and management, they introduce vulnerability to cyberattacks. Water utilities face pressure to modernize their infrastructure, but decisions about connectivity involve careful consideration of risk versus benefit.
The warning comes as critical infrastructure security remains a priority for government agencies and private sector organizations. Both public water systems and private utilities have experienced targeted cyber operations in recent years, leading to increased focus on defensive measures and security protocols.
The ex-NSA official’s recommendation represents a perspective that emphasizes air-gapping as a security measure for the most critical control systems—keeping them physically or logically isolated from networks rather than attempting to secure them through software protections alone.
Key facts
- An ex-NSA chief has stated water system controllers should not be connected to the internet
- The warning follows suspected cyberattacks attributed to Iran
- The recommendation reflects concerns about protecting critical infrastructure from remote cyber operations