• •Former NSA Director George Barnes stated publicly that industrial control systems for water utilities should not have direct internet connectivity.
• •The recommendation follows reports of suspected cyberattacks linked to Iranian actors targeting utility infrastructure.
• •While industry experts agree on the risk, there is no public data on how many municipal water systems currently maintain open internet access for their controllers.

Former NSA Director George Barnes recently advised that critical water system controllers must be air-gapped from the public internet. This warning follows a string of suspected Iranian-backed cyberattacks on utility systems, which have heightened fears regarding the vulnerability of public infrastructure. While the security risks of internet-facing operational technology are well-documented, municipal systems often struggle to implement these safeguards due to legacy equipment and limited IT budgets. Whether utilities will receive federal mandates to isolate these systems remains the primary point of uncertainty for the industry.