Water system controllers don't belong on the internet, says ex-NSA chief
Points and comments are a snapshot, not live.
Former NSA director says PLCs must be removed from the internet after suspected Iran attacks.
Retired Gen. Paul Nakasone stated at DEF CON that PLCs controlling US water systems should not be internet-connected, following hacks in at least 12 states. The FBI suspects Iranian-linked actors but has not officially blamed them. Nakasone called for higher standards and partnerships, citing 50,000 US water municipalities. He noted Iran has the capability and intent, and pointed to volunteers in the DEF CON Franklin project helping secure water facilities.
What commenters are saying
Top comment argues Nakasone is both right and wrong: old PLCs shouldn't be online, but newer ones could be with proper security. A split emerges between those insisting on air gaps and those advocating hardened VPNs or data diodes. One commenter notes many systems use insecure local RF links rather than the internet, and physical security at remote sites is often poor. Another suggests webcam-pointing-at-gauge as a viable air-gapped monitoring solution.