Ex-NSA chief: water utility controllers don't belong on the internet

The former director of the US National Security Agency has said that the equipment running water systems should not be connected directly to the internet. His remarks were prompted by a string of incidents linked to suspected attacks attributed to Iran.

The logic is simple: the industrial controllers responsible for supplying and treating water were designed to operate on isolated networks, not to be reachable by anyone who cares to look from the outside. The moment such a controller becomes visible from the internet, it turns into a convenient target — and the security of critical infrastructure starts to hinge on whether someone bothered to change the default password.

The problem has long been familiar to cybersecurity specialists: many utility facilities are run by outdated systems that administrators hook up to public networks for the convenience of remote access. That makes them easier to operate, but at the same time it opens the door to those hunting for vulnerable targets around the world.

The former intelligence chief's position comes down to an obvious but routinely ignored principle: critical infrastructure requires network isolation. As long as the controllers remain reachable from outside, any strain in international relations risks turning not only into diplomatic fallout but into very tangible trouble for the systems that everyday life depends on.

Source: Hacker News