Introduction
Supervisory control and data acquisition (SCADA) pertain to control systems that monitor collected data that is processed by a central computer or displayed for operator supervision. They are utilized in many industries to monitor and control complex systems. SCADA systems are usually made up of remote terminal units (RTUs) to remotely monitor conditions and programmable logic controllers (PLCs) to control systems and machinery. For human operators to monitor the data, SCADA employs Human machine interfaces (HMI) to display processed information (Tech-FAQ, n.d.). Similar to any other system that works with vital data and communications, SCADA systems come with their own cybersecurity risks.
Usage in Industry
“Examples of SCADA applications include monitoring water levels in reservoirs, controlling the temperature in HVAC systems in buildings, and managing traffic lights in smart city infrastructures (Empowered Automation Solutions, 2024).” SCADA applications allow for communication across machinery and environment conditions for greater control over organization systems. They play a critical role by being able to centralize data processing and display by communicating across many different RTU and PLC interfaces that utilize open-source or non-proprietary communication protocols. Reports on failing equipment or dangerous conditions is imperative for worker safety and maintaining availability of resources.
SCADA systems are a perfect use case for the CIA triad. Confidentiality is important because only authorized personnel should have access to the system to have a controlled response to irregularities in the displayed data. Unauthorized access could lead to improper responses that may exacerbate the situation. Integrity is vital for the machinery involved because false negatives in collected diagnostic data could be a major safety hazard for operators. Availability ensures that monitoring systems can regularly poll machinery and sensors for conditions and readings in order for decisions to be made if necessary.
SCADA Cybersecurity Vulnerabilities
SCADA system vulnerabilities depend on the implementation. If SCADA systems use an online resource to manage RTU and PLC devices, they risk attack vectors like any other online software. Bad actors can get access to credentials by phishing attempts or leaked passwords. This could lead to halted operations or manipulation of machinery controls causing damage to machinery, sensors, or even people.
Another attack vector is the physical manipulation of the equipment such as HMI, PLC, RTU, or networks. With physical access, bad actors can manipulate the information being communicated, shut down systems, or damage the equipment. Manipulation of information may be the greatest risk. As stated before, if incorrect information is shown on HMIs, operators may not know about certain faults or issues with machinery which may cause injury or damage. Shutting down systems and damaging equipment may inhibit organizational operations preventing access to data or machinery.
Security Strategies
For online SCADA systems, the main security measures include industrial VPNs, strong credentials, and multi-factor authentication. Industrial VPNs will help secure communication across the Internet, preventing attackers from being able to sniff packets and perform man-in-the-middle attacks. Properly educating those with authorized access to the systems about cybersecurity risks will help keep their credentials secure. This may include recognizing phishing attempts and utilizing different passwords for different sites. Multi-factor authentication helps add an extra layer of protection in case some credentials are compromised.
To prevent physical breaches of equipment, organizations should use proper equipment maintenance, visitor and employee logs, and facility security features. Diagnosis and maintenance of equipment can help detect irregularities with hardware or software components to ensure that each piece of equipment or sensor works as intended. Multiple sensors could also be utilized to ensure consistency. Visitor and employee logs help keep the organization accountable for who is given access to buildings with important machinery. Facility security features include security cameras to detect physical tampering, as well as locked doors, guards, and checkpoints to help ensure SCADA system integrity.
Conclusion
Overall, SCADA systems help organizations integrate data communication across many systems to assist in operations. Like any other important system, security is imperative especially if it concerns machinery that could cause injuries. Attack vectors will depend on the facility and system, but usually there are online threats and physical threats. For online threats, countermeasures are similar to those used for other online services, including secure connections and strong credentials and authentication. Physical threats require a different approach with facility security and monitoring to prevent unauthorized manipulation or access to equipment.
Citations
Tech-FAQ. (n.d.). SCADA. https://www.tech-faq.com/scada.html
Empowered Automation Solutions. (2024, December 23). SCADA applications. https://www.empoweredautomation.com/scada-applications