Former NSA Chief: Water Systems Should Not Be Connected to the Internet
Iran-linked cyberattacks target US water facilities.
1Target of Cyberattacks
Water systems in at least 12 US states have been hacked, likely by Iran-linked cyber actors. These attacks target Programmable Logic Controllers (PLCs) in water facilities. These devices monitor sensor data like tank levels and can turn pumps on and off. The FBI announced in late July that it was investigating these attacks.
2Paul Nakasone's Warning
Former NSA Chief Paul Nakasone emphasized during his speech at DEF CON that water systems should not be connected to the internet. Nakasone said, "These PLCs should not be connected to the internet." He also noted that the US is in conflict with Iran and that Iran has the capability to carry out such attacks.
3Vulnerability of Water Systems
Water systems in the US present a large attack surface due to historical underfunding and limited IT staff. Some facilities don’t even have dedicated cybersecurity personnel. Nakasone pointed out that there are 50,000 different water municipalities and that 90% of US water comes from these facilities.
4DEF CON Franklin Project
The DEF CON Franklin project was launched two years ago, with hackers volunteering to help secure water facilities. Nakasone emphasized that such partnerships are necessary to protect critical infrastructure. The project is also linked to Project Chimera, a cybersecurity platform built on open-source technologies.
5Role of Project Chimera
Project Chimera is a platform developed by academics and cybersecurity practitioners. It aims to enhance the resilience of critical infrastructure using open-source technologies. Nakasone serves as the founding director of this project and continues his work at Vanderbilt University's Institute of National Security.
6Iran's Role
Private-sector security researchers suspect that Iran-linked cyber actors are targeting water and wastewater facilities. Cynthia Kaiser, SVP of the Halcyon Ransomware Research Center, said, "I'd be shocked if it's not Iran." However, the FBI and the Trump administration have not officially blamed Iran.
7Measured Approach
Nakasone said the FBI is taking a measured approach to attributing the attacks. However, he noted that Iran has a history of such attacks and possesses the capability. Nakasone stated, "We're in conflict with Iran," highlighting the seriousness of the situation.
8Next Steps
Nakasone emphasized the need for a broader network of partnerships to protect water systems. He called for a more comprehensive defense strategy than the current approach. This could be achieved through collaboration between the public and private sectors.