{"id":288,"date":"2026-10-04T19:08:41","date_gmt":"2026-10-04T19:08:41","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/riley-copeland\/?p=288"},"modified":"2026-10-04T21:40:11","modified_gmt":"2026-10-04T21:40:11","slug":"scada-systems","status":"publish","type":"post","link":"https:\/\/sites.wp.odu.edu\/riley-copeland\/2026\/10\/04\/scada-systems\/","title":{"rendered":"SCADA Systems"},"content":{"rendered":"\n

Riley Copeland | 9\/19\/06
SCADA Systems and the Security of Critical Infrastructure<\/strong><\/p>\n\n\n\n

SCADA (Supervisory Control and Data Acquisition) systems let a small team monitor
and control equipment spread over a large area, like a plant or city. Field sensors feed into
devices called RTUs and PLCs, which turn signals into digital data and handle most of the
automatic control. A central station sends that data to an operator’s screen, called an HMI. The
operator doesn’t run things by hand. They watch alarms and setpoints and step in only when
something needs adjusting. SCADA is a big deal for critical infrastructure because a few people
can watch over pipelines miles away. NIST classifies SCADA as operational technology,
meaning programmable systems that monitor or control the physical world (Stouffer et al.,
2023).<\/p>\n\n\n\n

How SCADA Is Used Across Industrie<\/strong>s<\/p>\n\n\n\n

SCADA is used in almost every critical sector. The easiest example is the power grid.
Utilities use SCADA to open and close breakers from a control room instead of sending someone out to every substation. Water utilities run pumps and chemical dosing the same way, which matters for the Florida case below. Transportation, manufacturing, and even hospital power systems use similar setups.<\/p>\n\n\n\n

Vulnerabilities and Risks<\/strong><\/p>\n\n\n\n

The biggest problem is that systems built to be isolated aren’t isolated anymore. Older
systems were safe because they were isolated and used proprietary protocols. Today they run on standard internet protocols and can often be reached remotely. Many control protocols have little or no built-in security, so anyone who can send packets to a device may be able to control it. The old idea that a SCADA network is safe because it’s offline or physically secured no longer holds (SCADA Systems, n.d.). Access control is the other weak spot. In February 2021, unidentified actors remotely accessed the SCADA system at a Florida water treatment plant and raised the level of sodium hydroxide, a caustic chemical. Staff caught the change and reversed it before it reached the public. Investigators traced the intrusion to poor password practices and an unsupported operating system (Cybersecurity and Infrastructure Security Agency [CISA] et al.,
2021).<\/p>\n\n\n\n

Impact of an Attack<\/strong><\/p>\n\n\n\n

A SCADA attack is different from a normal data breach because the damage can be
physical. In December 2015, attackers cut power to up to 225,000 customers across three
Ukrainian utilities. They had been inside the networks for months before pulling the trigger, and crews had to switch to manual operations to restore service (Lee et al., 2016). A similar attack on a U.S. utility could cut power, or shut down emergency services.<\/p>\n\n\n\n

If I had to pick one place to start, it would be separating the IT and business networks
from the operational technology that runs the equipment. Once they’re split, someone who breaks into the office network still can’t reach the controls (Stouffer et al., 2023). Next would be fixing the basics from the Florida case. Multifactor authentication and replacing unsupported operating systems would have prevented the attack. Plants also need a way to keep running when something fails. Ukrainian operators got power back within hours because they could switch to manual control (Lee et al., 2016). None of this is simple, because a running plant can’t always be patched and rebooted on demand.<\/p>\n\n\n\n

References<\/strong><\/p>\n\n\n\n

Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation,
Environmental Protection Agency, & Multi-State Information Sharing and Analysis
Center. (2021). Compromise of U.S. water treatment facility (Alert AA21-042A).
https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa21-042a
Lee, R. M., Assante, M. J., & Conway, T. (2016). Analysis of the cyber attack on the Ukrainian
power grid: Defense use case. Electricity Information Sharing and Analysis Center &
SANS Industrial Control Systems.
https:\/\/nsarchive.gwu.edu\/sites\/default\/files\/documents\/3891751\/SANS-and-Electricity-I
nformation-Sharing-and.pdf
SCADA systems. (n.d.). [Course reading]. Google Docs.
https:\/\/docs.google.com\/document\/d\/1DvxnWUSLe27H5u8A6yyIS9Qz7BVt_8p2WeNH
ctGVboY\/edit
Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia,
S., Sherule, A., & Thompson, M. (2023). Guide to operational technology (OT) security
(NIST Special Publication 800-82r3). National Institute of Standards and Technology.
https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-82r3.pdf<\/p>\n","protected":false},"excerpt":{"rendered":"

Riley Copeland | 9\/19\/06SCADA Systems and the Security of Critical Infrastructure SCADA (Supervisory Control and Data Acquisition) systems let a small team monitorand control equipment spread over a large area, like a plant or city. Field sensors feed intodevices called RTUs and PLCs, which turn signals into digital data and handle most of theautomatic control…. <\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":32740,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/posts\/288"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/users\/32740"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/comments?post=288"}],"version-history":[{"count":3,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/posts\/288\/revisions"}],"predecessor-version":[{"id":298,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/posts\/288\/revisions\/298"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/media?parent=288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/categories?post=288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/riley-copeland\/wp-json\/wp\/v2\/tags?post=288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}