What are SCADA Systems?
Supervisory Control and Data Acquisition, or SCADA, refers to Industrial Control Systems (ICS) that are in charge of controlling infrastructure processes such as water treatment, wastewater treatment, gas pipelines, and wind farms. Facility-based processes include airports, space stations, and ships. Industrial processes include production, manufacturing, refining, and power generation.
These are coordinated by SCADA at the supervisory level. SCADA systems can monitor and supervise entire sites or systems distributed across large geographic areas. Almost all control actions are performed by remote terminal units (RTUs) or programmable logic controllers (PLCs).
The Human-Machine Interface (HMI) is another part of the SCADA system. The HMI is the user interface that presents processed information to the human operator and lets the operator interact with the system. (“SCADA Systems,” n.d.)
How are SCADA systems used in industries?
SCADA systems are used in industries in many different ways to monitor, gather, and control industrial processes in remote and local infrastructure.
For example, in water treatment facilities, SCADA is responsible for monitoring things such as flow, pressure, equipment status, pumps/valves, and alarms. In energy infrastructure, SCADA is responsible for monitoring and controlling power generation, electrical substations, and transmission systems.
In the transportation industry, SCADA is responsible for things such as railway systems, traffic lights, and airports (“SCADA Systems,” n.d.).
Cybersecurity vulnerabilities in SCADA systems
Cybersecurity in SCADA systems is crucial, as any vulnerabilities found in these systems can cause real damage to the infrastructure and affect civilian lives. Based on the article SCADA Systems (n.d.), there are two major threats: unauthorized access to software and network/control protocol weaknesses.
This first threat includes unauthorized human access, malicious changes to software, malware infections, compromise of the control host, and more. The reason why this can be so devastating is that if an attacker gains access to the system controlling and supervising a physical process, they can manipulate how the process operates, possibly causing damage to the infrastructure.
The second vulnerability relates to the packet access network segments that host SCADA devices. Based on the article, network protocols historically have had little or no security at all in the actual packet control protocol, creating the possibility of an attacker being capable of sending packets to a SCADA device to potentially control it (“SCADA Systems,” n.d.).
Effects of a cybersecurity attack on SCADA systems.
Given these possible threats in SCADA systems, how would a cyberattack on a SCADA system actually affect organizations, infrastructure, and society? A cyberattack exploiting these vulnerabilities could lead to SCADA manipulation, leading to physical process disruptions and organizational and societal damage.
For example, a breach of a SCADA system responsible for water supplies could cause manipulation of water treatment or supply plants, potentially affecting water quality and availability.
A disruption in power grids could lead to shutting down power generation or distribution, leading to widespread blackouts and affecting homes, hospitals, and traffic lights.
An attack on the transportation infrastructure would disrupt rail, aviation, and traffic networks, causing significant transit delays (Glenski & Jennings, 2024).
Strategies to improve security of SCADA systems
There are already cybersecurity controls and mitigation strategies, but organizations should focus on improving them and adding new layers of security, especially for such critical infrastructure. Some strategies they could implement are asset management/inventory, vulnerability assessment and management, and privilege/access management.
Asset management/inventory is crucial. Organizations should know what devices are connected to their SCADA network. This helps identify unauthorized devices and understand their system.
Vulnerability assessment and management are also important, as organizations should regularly identify vulnerabilities. However, the authors of Alanazi et al. (2023) point out that regular automated vulnerability scanning can be problematic for SCADA systems, as it can interrupt critical services. They discuss how passive vulnerability assessment is a positive alternative.
Privilege/access management is another important strategy organizations can use. Organizations should restrict users to only be able to access what they actually need and follow the principle of least privilege. Proper authentication and authorization systems can help prevent unauthorized access to SCADA systems. Another important point from the Alanazi et al. (2023) paper is that traditional IT cybersecurity controls cannot simply be applied to operational technology (OT) systems and ICS, as SCADA has operational requirements that ordinary IT systems don’t have.
Another important consideration is resilience. Organizations can achieve this through the use of redundant/backup systems, disaster recovery capabilities, backup servers, and failover servers (Alanazi et al., 2023). It is also important to know the distinction between security and resilience. Security tries to prevent or detect an attack, and resilience helps an organization continue operating or recover when something goes wrong.
Conclusion
Overall, the importance of SCADA systems cannot be overstated. SCADA systems play an important role in critical infrastructure like energy, water, and transportation by allowing operators to monitor and supervise these systems. Unfortunately, there are cybersecurity vulnerabilities that could lead to attacks causing physical damage to this critical infrastructure. Cyberattacks could take advantage of digital vulnerabilities to cause physical damage, which is why it is necessary to implement proper security and resilience.
