🟠 High | Source: The Register — Security
A former NSA chief has warned that water system industrial controllers should not be internet-facing, following suspected Iranian cyberattacks targeting water infrastructure. The incidents highlight longstanding operational technology (OT) security failures where critical systems remain directly exposed online. This is a recurring pattern that puts public safety at serious risk and demands urgent remediation from asset owners and defenders.
Security Architect’s Take: If your organisation manages or consults on any OT or ICS environments — including hybrid cloud-connected SCADA systems — conduct an immediate internet-exposure audit using tools such as Shodan or Censys, then enforce strict network segmentation and remove any direct internet connectivity from PLCs and HMIs, replacing with secure remote access solutions such as zero-trust gateways or jump servers with MFA.
Original advisory: Water system controllers don’t belong on the internet, says ex-NSA chief after suspected Iran attacks