Bluff:

As threat actors globally turn their attention to critical infrastructure, there is now a greater need to protect it. The use of legacy technologies, weak access control practices, and poor network architecture have left critical infrastructure vulnerable to attack. Critical infrastructure systems around the world use Supervisory Control and Data Acquisition (SCADA) systems to control and monitor critical infrastructure and processes. SCADA systems, especially as they modernize and become network and IP-based, are uniquely situated to leverage SCADA architecture to combat these vulnerabilities and to help organizations identify and respond to today’s threats. ______________________________________________________________________________

Introduction:

As the world’s population grows, so do its infrastructure needs. Critical infrastructure worldwide includes sectors such as power, water, gas, and manufacturing, all of which are essential to our daily lives. As a result of this reliance, threat actors are targeting this infrastructure, making its protection imperative. Due to the sheer scale of these systems, management has become a challenge, and as a result, the industry has become reliant on technologies that enable the remote control and management of our infrastructure. These systems are known as Supervisory Control and Data Acquisition systems. NIST defines Supervisory Control and Data Acquisition (SCADA) systems as computerized systems that can gather, process data, and apply operational controls over long distances. (NIST SP 800-82 rev 3) This control over distance has made SCADA systems a core piece of infrastructure management, but they do not come without their own inherent risk. Despite this additional risk because of where SCADA systems sit on the network, they are one of the best enforcement points available for the security of these critical systems. 

Vulnerabilities Associated with Critical Infrastructure

When we examine our critical infrastructure systems through a cyber security lens, we are able to find a number of threat vectors that must be considered. According to a study done by Checkpoint Security, the number one issue faced by industrial control systems is legacy software. Many of today’s systems operate on legacy technology stacks which lack strong authentication and data integrity checks. This opens the door for threat actors to easily gain access to and manipulate the information of these systems, leaving them highly susceptible to attack. A second risk we see is the continued use of the default configuration. When using out-of-the-box configuration, it is easier for a threat actor to explain a weakness in the configuration. We have seen this happen in the past when Target was hacked via an industrial control system (ICS). According to a writeup by framework security, once the threat actors had access to the HVAC system, they were able to traverse the network and gain access to Target’s point of sales (POS) system. This allowed them to intercept and capture customer payment information and PII. The Target breach is also a great example of another issue our critical infrastructure faces: poor network segmentation policies. In much the same way access to the HVAC system should not allow access to the POS system, access to the guest network should not allow access to the systems controlling water filtration systems. The lack of proper network segmentation opens the attack aperture for threat actors, allowing multiple points of ingress to critical infrastructure. More recently than the Target breach, CPO magazine published an article in February of this year in which 300 critical infrastructure organizations were hit with malware. The article describes the need for critical infrastructure to be patched and updated and outlines the FBI’s and CISA’s recommendations. The combination of all the aforementioned vulnerabilities plus the many more not covered makes our critical infrastructure a target for threat actors. At the core of much of this critical infrastructure is Supervisory Control and Data Acquisition (SCADA) systems, which are designed to help monitor and control the infrastructure.

SCADA Systems and Risk Mitigation: 

Supervisory Control and Data Acquisition (SCADA) systems are designed to monitor and control infrastructure and processes remotely. This is achieved by collecting information from the systems and communicating with remote terminal units (RTUs) or programmable logic controllers (PLCs) to execute commands. While SCADAs originated as mainframe-based, the latest generation is network-based, making them accessible through the internet. Due to this network accessibility, SCADA present a number of security risks; however, they are also uniquely positioned as a cybersecurity enforcement point. One of the core functions of SCADA’s is real-time monitoring of the systems they connect to. This real-time data collection enables SCADA to perform various cybersecurity functions, such as real-time monitoring, anomaly detection, and logging. This allows SCADA to detect anomalous behavior and provide a trail of what may have been done and even how intrusion was achieved. In the same vein, enhancing the access control capabilities of SACDA to include authentication best practices such as multifactor authentication and role-based access controls adds an additional layer of protection for critical infrastructure. In tandem with enhanced access controls, native network segmentation will help ensure that not only is the correct user accessing the system, but should a threat actor gain access, they will be prevented from moving laterally within the system.

Conclusion:

Critical infrastructure will always be under threat from cybercriminals because of its role in our everyday lives and its ability to cause widespread devastation. As we continue to automate and modernize critical infrastructure management, so should the management tool. Where appropriate, the network for our critical systems should be isolated and protected with strong authentication. Should an issue arise, be it anomalous or otherwise, we should capture this information to take the appropriate remediation. Supervisory Control and Data Acquisition (SCADA) systems bring not only scale to the management of our critical infrastructure but also the potential for a better cybersecurity posture. As modern implementations of SCADA come to the market, cybersecurity needs to be baked into the DNA of these systems ensuring the protection of the world’s critical infrastructure.

Reference:

Stouffer, Keith. “NIST SP 800-82r3: Guide to Operational Technology (OT) Security.” Guide to Operational Technology (OT) Security, 1 Jan. 2023, nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf, https://doi.org/10.6028/nist.sp.800-82r3.

‌TOP 10 CRITICAL INFRASTRUCTURE and SCADA/ICS CYBERSECURITY VULNERABILITIES and THREATS Operational Technology (OT) Systems Lack Basic Security Controls. Below Are the Most Common Threats: Vulnerabilities Threats Legacy Software Lack of Network Segmentation. www.checkpoint.com/downloads/products/top-10-cybersecurity-vulnerabilities-threat-for-critical-infrastructure-scada-ics.pdf.

“The Target Breach: A Historic Cyberattack with Lasting Consequences – Oct 01, 2024.” Frameworksec.com, 2 Oct. 2024, www.frameworksec.com/post/the-target-breach-a-historic-cyberattack-with-lasting-consequences.

Hope, Alicia. “Over 300 Critical Infrastructure Organizations Hit by Medusa Ransomware Attacks.” CPO Magazine, 21 Mar. 2025, www.cpomagazine.com/cyber-security/over-300-critical-infrastructure-organizations-hit-by-medusa-ransomware-attacks/?utm_source=chatgpt.com.