Madison Williamson

Scada systems are a monitoring and control system used in a variety of infrastructure, facilities, and manufacturing sites. They can be used in waste management, power generation, manufacturing, and airport management. They are made up of three specific parts. An Human Machine Interface (HMI) which allows an operator to control and monitor the facility or equipment they are in charge of, making it easier to keep track of power generation, water flow, or equipment temperature. Supervisory Station Software which takes information from all outside sources and points, parses the information, and if necessary applies a predetermined algorithm to it to make it legible to the operator. And finally the Remote Terminal Unit (RTU) or Programmable Logic Controller (PLC) which are the end points that gather information from equipment, pathways, and can control the flow or process of equipment, pipes, electrical circuits, and assembly lines.

A more specific example of how a SCADA system operates is waste management. In larger cities these systems are implemented to ensure that no waste piping overflows or is blocked. The PLCs or RTUs monitor key paths in the drainage network and note the level of flow or how full a tank is. They take this information and send it to the Supervisory Station Software which makes the information readable to humans and send it to the HMI. The operator is then able to determine if a backup is occurring in the network, and if actions need to be taken to prevent any damage to pipeways, or potential flooding to occur on the streets or neighborhoods above. These systems are invaluable but the service they provide is only noticed when they fail.

Following along with the previous paragraph, a bad actor could easily utilize the SCADA system to cause damage or frustration among any targeted community. We’ve seen it historically already where hackers gain access to systems remotely through the internet and put malware on clients, preventing operations from continuing. But if a hacker were to say, change the data the PLCs and RTUs are outputting to show the system as fully functioning without issue, they could cause flooding to occur. Or in a more high damage attack, attackers could gain access to a nuclear power facility, do the same thing they did with the PLCs and RTUs of the drainage systems this time with the temperature of the facilities nuclear power rods, causing a site meltdown or worse. These systems are of course vastly different in scale and function, but if an attacker already knows how to change information coming from PLCs and RTUs, they can figure that out in any SCADA system.

These types of attacks could be used to create disgruntled citizens against their local government, disrupt supply chains in manufacturing causing delays in material being delivered or even life saving equipment to be created. And they can be used to put a halt on an entire state’s power supply, causing thousands or even millions, depending on the state, to go without power during a time in the year where AC or heat is needed to survive. All of these can also be combined to cripple an area allowing for further attacks to happen while the receiving area is still trying to recuperate. Of course they are not solely attacking state or nation bodies, and corporations could be affected through the same means as disrupting supply chains, or damaging important equipment to the point of replacing it, delaying the corporations output and harming the bottom line.

I’m personally an advocate for systems such as these to be inaccessible from outside the facility. All devices should be sourced in house and a Bring your own device policy should not be implemented. If you work on one of these systems all correspondence goes through approved devices no matter the loss of convenience. Personnel need to be trained to understand no outside device, bluetooth, or usb should be brought into the facility. We’ve seen in the past with the first Stuxnet attack how an outside device being plugged into a network can cause immediate and undetectable damage to a facility faster than it can be noticed. Beyond those simple training and access requirements, a software scan should be implemented at all times to monitor ports for the system and, looking at any new files or applications to ensure they are not being corrupted or changed in any way.