4 ms·

Sadly this instantly became a political football, with the states pointing fingers at Iran, but Trump was not wrong in this case. This is gross incompetence at

Sadly this instantly became a political football, with the states pointing fingers at Iran, but Trump was not wrong in this case. This is gross incompetence at all levels — IT malpractice if you will. CISA and its predecessors have been warning utility operators about critical infrastructure vulnerabilities for what, 15 years at this point? That goes back to the first Obama administration. Yet here we are in 2026 and these utilities are still connecting these things to the raw Internet with default passwords. You cross a threshold where you're being deliberately careless. When you are putting more effort into securing your Plex server on your home network then public utilities are taking on machinery that dumps chemicals into the local water, something is not right and finger-pointing isn't going to fix it.

andyjohnson0 3mo ago
> Yet here we are in 2026 and these utilities are still connecting these things to the raw Internet with default passwords. I work with PLCs. Default passwords of not, the idea that such weakly secure devices are being made accessible from the public internet boggles my mind.
- pudgywalsh 3mo ago
  Yeah I meant the default passwords are simply the cherry on top of already egregiously poor security.
- fathermarz 3mo ago
  What industry? Very relevant.
  - andyjohnson0 3mo ago
    Not utilities. And none of the PLCs I work with are internet-connected or unsecured.
Avicebron 3mo ago
I think it's less carelessness and more the inability to attract (pay) people who have the technical knowhow to properly secure infrastructure. Even a lot of developers are poor network engineers and treat IT like magic at their own companies.
- pudgywalsh 3mo ago
  I've met info-sec / vulnerability researcher types that were egregiously reckless, like plugging Raspberry Pi's into the production network kind of thing. Public sector has always paid low. But the problem is widespread, almost universal, and they've had a 15 year head start of the federal government telling them to get their shit together. At some point it just became standard industry practice is my guess.
  - doobiedowner 3mo ago
    Upgrades to waste water are project based. Lowest bidder will not provide security for free. Security may be mentioned in spec but in hand waved language that can be hand waved away. That company doing the improvement project will have next to no documentation from the previous engineering effort. Just do bare minimum and move on to next job, because no one is getting paid enough to do put in more effort.
    - antonymoose 3mo ago
      Depends on the firm. Quite many water companies handle their own engineering and only outsource when absolutely necessary, think speciality tunnel boring companies.
  - elictronic 3mo ago
    In all things when it fails in a drastic way the system will be corrected. People will die, it will suck, changes will be made. Government is supposed to respond to these things and create incentives to correct. Telling a small municipality to do something without a carrot ir stick does nothing. In this instance someone else will be providing the stick.
idontwantthis 3mo ago
Until the people in charge face jailtime for hurting innocent people, why would they care? The government shouldn’t be warning, it should be ordering and imprisoning. And funding and educating where there are genuine gaps.
lorreyfum 3mo ago
Absolutely 100% spot on. It’s not a political issue, it’s a technical issue. Disconnect them from the internet. Run your security patches. Check your logs. Water supplies are pretty important, do your job.
- throwaway894345 3mo ago
  Kind of feels like national security is the job of the federal government. Seems fair to say the federal government should do their job. They started a war for no reason and failed to anticipate not only these infrastructure breach but also the closure of the Hormuz strait.
  - pudgywalsh 3mo ago
    So the federal government should be responsible for every rinky-dink water well in Bumblefuck, Minnesota? > failed to anticipate not only these infrastructure breach They've been warning them for close to two decades. Minnesota chose the path of no locks on their front doors and are now crying that someone walked in without knocking first.
    - throwaway894345 3mo ago
      The federal government makes sure everyone who sends a venmo for $60 pays taxes on it so yeah I think securing our national infrastructure is not an unreasonable expectation.
      - zdragnar 3mo ago
        There's no "national infrastructure" for water. Aside from what the EPA does, it isn't within the remit of the federal government to manage municipality water systems.
        throwaway894345 3mo ago
        My wording was ambiguous. “national infrastructure” can refer to either the infrastructure in our nation or infrastructure managed by the federal government. I meant the former.
cyanydeez 3mo ago
a broken clock, yada yada.
throwaway894345 3mo ago
Yes, utilities shouldn’t be negligent, but national security is 100% the federal government’s responsibility. If the vulnerabilities were so trivial, then it’s even more damning that the federal government was caught with its pants down, particularly since they were the only ones who knew they would be starting a war. > finger-pointing isn't going to fix it. Your entire comment was finger pointing…
- fathermarz 3mo ago
  There are over 150k water utilities alone in the US. Passing the buck to the Federal Government is not understanding the problem.
  - throwaway894345 3mo ago
    There are 1000x as many tax payers and the government still makes sure every single mom who gets a venmo payment for $60 pays taxes. National security is a federal responsibility, they should absolutely do their jobs.
    - anamax 3mo ago
      > There are 1000x as many tax payers and the government still makes sure every single mom who gets a venmo payment for $60 pays taxes. That's a join in an existing database. Where's the database and what's the code for this case?
      - throwaway894345 3mo ago
        Is the idea that the federal government of the United States, which created and maintains a database of hundreds of millions of taxpayers, is powerless compile a database of 0.1% that number of water utilities? > What's the code for this case? Are you seriously asking me to provide a program?
        fathermarz 3mo ago
AnimalMuppet 3mo ago
"I blame it on Minnesota because they are grossly incompetent." "I think Minnesota is behind it." The first quote makes it the state's responsibility to secure local water systems, which I'm not sure that it is. The second makes it at least sound like the state of Minnesota is the entity running the attack on local water systems within their state, which is off in paranoid conspiracy territory. Trump was absolutely wrong.
fathermarz 3mo ago
Not IT malpractice and this where the industry diverges. IT folks usually don’t work on or understand these systems. Which is one of MANY problems OT faces. IT best practices don’t suffice in OT and even when they do, most of these orgs are too resource hamstrung to do anything about all of the fires they have to put out. Not to mention all of the OT vendors who flooded the market with tools instead of people being taught the boring process driven work.
dylan604 3mo ago
CISA was formed in 2018, so not quite 15 years but closer to half that. The security industry as a whole has been yelling for longer than 15 years about the vulnerability of utilities. They've been marked as soft targets before the Bush administration restructured the government.

andyjohnson0 3mo ago

> Yet here we are in 2026 and these utilities are still connecting these things to the raw Internet with default passwords. I work with PLCs. Default passwords of not, the idea that such weakly secure devices are being made accessible from the public internet boggles my mind.

pudgywalsh 3mo ago
Yeah I meant the default passwords are simply the cherry on top of already egregiously poor security.
fathermarz 3mo ago
What industry? Very relevant.
- andyjohnson0 3mo ago
  Not utilities. And none of the PLCs I work with are internet-connected or unsecured.

Avicebron 3mo ago

I think it's less carelessness and more the inability to attract (pay) people who have the technical knowhow to properly secure infrastructure. Even a lot of developers are poor network engineers and treat IT like magic at their own companies.

pudgywalsh 3mo ago
I've met info-sec / vulnerability researcher types that were egregiously reckless, like plugging Raspberry Pi's into the production network kind of thing. Public sector has always paid low. But the problem is widespread, almost universal, and they've had a 15 year head start of the federal government telling them to get their shit together. At some point it just became standard industry practice is my guess.
- doobiedowner 3mo ago
  Upgrades to waste water are project based. Lowest bidder will not provide security for free. Security may be mentioned in spec but in hand waved language that can be hand waved away. That company doing the improvement project will have next to no documentation from the previous engineering effort. Just do bare minimum and move on to next job, because no one is getting paid enough to do put in more effort.
  - antonymoose 3mo ago
    Depends on the firm. Quite many water companies handle their own engineering and only outsource when absolutely necessary, think speciality tunnel boring companies.
- elictronic 3mo ago
  In all things when it fails in a drastic way the system will be corrected. People will die, it will suck, changes will be made. Government is supposed to respond to these things and create incentives to correct. Telling a small municipality to do something without a carrot ir stick does nothing. In this instance someone else will be providing the stick.

idontwantthis 3mo ago

Until the people in charge face jailtime for hurting innocent people, why would they care? The government shouldn’t be warning, it should be ordering and imprisoning. And funding and educating where there are genuine gaps.

lorreyfum 3mo ago

Absolutely 100% spot on. It’s not a political issue, it’s a technical issue. Disconnect them from the internet. Run your security patches. Check your logs. Water supplies are pretty important, do your job.

throwaway894345 3mo ago
Kind of feels like national security is the job of the federal government. Seems fair to say the federal government should do their job. They started a war for no reason and failed to anticipate not only these infrastructure breach but also the closure of the Hormuz strait.
- pudgywalsh 3mo ago
  So the federal government should be responsible for every rinky-dink water well in Bumblefuck, Minnesota? > failed to anticipate not only these infrastructure breach They've been warning them for close to two decades. Minnesota chose the path of no locks on their front doors and are now crying that someone walked in without knocking first.
  - throwaway894345 3mo ago
    The federal government makes sure everyone who sends a venmo for $60 pays taxes on it so yeah I think securing our national infrastructure is not an unreasonable expectation.
    - zdragnar 3mo ago
      There's no "national infrastructure" for water. Aside from what the EPA does, it isn't within the remit of the federal government to manage municipality water systems.
      - throwaway894345 3mo ago
        My wording was ambiguous. “national infrastructure” can refer to either the infrastructure in our nation or infrastructure managed by the federal government. I meant the former.

cyanydeez 3mo ago

a broken clock, yada yada.

throwaway894345 3mo ago

Yes, utilities shouldn’t be negligent, but national security is 100% the federal government’s responsibility. If the vulnerabilities were so trivial, then it’s even more damning that the federal government was caught with its pants down, particularly since they were the only ones who knew they would be starting a war. > finger-pointing isn't going to fix it. Your entire comment was finger pointing…

fathermarz 3mo ago
There are over 150k water utilities alone in the US. Passing the buck to the Federal Government is not understanding the problem.
- throwaway894345 3mo ago
  There are 1000x as many tax payers and the government still makes sure every single mom who gets a venmo payment for $60 pays taxes. National security is a federal responsibility, they should absolutely do their jobs.
  - anamax 3mo ago
    > There are 1000x as many tax payers and the government still makes sure every single mom who gets a venmo payment for $60 pays taxes. That's a join in an existing database. Where's the database and what's the code for this case?
    - throwaway894345 3mo ago
      Is the idea that the federal government of the United States, which created and maintains a database of hundreds of millions of taxpayers, is powerless compile a database of 0.1% that number of water utilities? > What's the code for this case? Are you seriously asking me to provide a program?
      - fathermarz 3mo ago

AnimalMuppet 3mo ago

"I blame it on Minnesota because they are grossly incompetent." "I think Minnesota is behind it." The first quote makes it the state's responsibility to secure local water systems, which I'm not sure that it is. The second makes it at least sound like the state of Minnesota is the entity running the attack on local water systems within their state, which is off in paranoid conspiracy territory. Trump was absolutely wrong.

fathermarz 3mo ago

Not IT malpractice and this where the industry diverges. IT folks usually don’t work on or understand these systems. Which is one of MANY problems OT faces. IT best practices don’t suffice in OT and even when they do, most of these orgs are too resource hamstrung to do anything about all of the fires they have to put out. Not to mention all of the OT vendors who flooded the market with tools instead of people being taught the boring process driven work.

dylan604 3mo ago

CISA was formed in 2018, so not quite 15 years but closer to half that. The security industry as a whole has been yelling for longer than 15 years about the vulnerability of utilities. They've been marked as soft targets before the Bush administration restructured the government.