Water system controllers don't belong on the internet, says ex-NSA chief

Critical infrastructure water systems across at least 12 US states have been compromised in suspected Iranian cyberattacks targeting programmable logic controllers (PLCs), prompting ex-NSA chief Paul Nakasone to warn that operational technology devices should never connect to the internet. With 50,000 fragmented US water municipalities historically underfunded and lacking dedicated cybersecurity staff, IT leaders must fundamentally redesign their defensive strategies through public-private partnerships and implement network segmentation to isolate critical operational technology from internet connectivity. This incident exposes a systemic vulnerability in critical infrastructure that demands immediate architectural changes and resource investment to prevent potential public health emergencies.