SCADA and ICS Security

• Purdue zones
• Passive only
• Modbus / DNP3 / PROFINET
• Safety-first

SCADA security fails when IT practice is applied unchanged. An active scan can knock over a PLC. An agent rollout can void a vendor warranty. The architecture has to assume none of that is available.

Zone and conduit architecture

The design principle is that traffic crossing a zone boundary passes through an inspected conduit, and traffic inside a cell is observed but never interfered with. Where the process allows it, the boundary between the DMZ and the supervisory layer is made one-way — a data diode or an equivalent — so no inbound path exists at all.

How we deploy without touching the process

1. Passive captureSPAN or TAP only. No active scanning, ever. An unexpected probe against a safety instrumented system is an incident in its own right.
2. Protocol decodeModbus, DNP3, BACnet, PROFINET, EtherNet/IP and vendor-proprietary traffic decoded so a setpoint change reads as a setpoint change.
3. BaselineIndustrial traffic is far more regular than IT traffic, which makes anomaly detection genuinely effective here — but only after a full production cycle is observed.
4. Boundary enforcementConduits implemented and tested during a planned outage, with the operations team present and a rehearsed rollback.
5. ExclusionsSafety systems registered as never-auto-isolate before any automation is enabled.

SCADA security consulting and assessment

Engagements usually start as one of two things. A SCADA security assessment is a fixed-scope review: passive asset discovery, conduit and boundary analysis, a mapped set of SCADA security vulnerabilities with exploitability weighted for an OT context, and a prioritised remediation plan that respects your outage calendar. SCADA security consulting is the longer engagement that follows — architecture, implementation and the operating model.

The SCADA security controls we assess against

• Zone and conduit design — IEC 62443 zones, with every conduit justified and inspected
• ICS/SCADA network security — segmentation between supervisory and process cells
• SCADA HMI security — workstation hardening, application allow-listing, and the removable media path that is still the most common entry point
• Authentication and least privilege — including the shared operator accounts that every plant has and few document
• Remote and vendor access — usually the widest and least monitored path in
• Backup and recovery — controller configurations and logic, restore-tested

SCADA security standards we map to

IEC 62443 for the architecture, NIST SP 800-82 for the control set, and NERC CIP where you are a registered entity. We map once to the underlying mechanism and derive each framework view from it, rather than running three parallel compliance exercises.

Unidirectional gateways

Where the process tolerates it, the strongest boundary is not a firewall rule but the absence of a receiver. A data diode permits historian data out to enterprise reporting and makes an inbound path physically impossible. The cost is real — no remote commands, no remote patching, no pull-based polling — and we scope that honestly before recommending one.

Choosing a boundary control

Control	Inbound possible	Cost	Use when
Firewall rules	Yes, by configuration	Low	Inbound access is genuinely required
Broker in a DMZ	Only to the broker	Medium	Bidirectional need, but no direct path acceptable
Data diode	No — physically	High	Outbound reporting only; highest-consequence processes

The SCADA threat model

SCADA security is a different category of risk from ordinary IT security because it bridges the digital and the physical. An IT breach costs you data. A successful SCADA attack can stop a production line, contaminate a water supply, or open a breaker on a grid. Legacy SCADA was designed for isolated environments, long before the network was hostile, so encryption and authentication were simply not part of the design.

Threat types

Threat	How it works here	Physical consequence
Industrial malware	Purpose-built code targeting control systems. Stuxnet altered centrifuge logic while reporting normal readings to operators; Industroyer spoke grid protocols natively to open breakers.	Equipment damage, process manipulation invisible to the control room
Ransomware	Usually not OT-aware. It encrypts the engineering workstations and HMIs, and production stops because operators are blind — not because controllers were touched.	Production halt, extortion
Command spoofing	Legacy protocols such as Modbus and DNP3 transmit in clear text with no authentication. Anyone who can reach a device can issue a valid-looking command.	Altered setpoints, forced valve states, suppressed alarms
Denial of service	Flooding the network blocks telemetry between field devices and the control room.	Operators blinded during a live physical emergency
Supply chain	Vendors need remote access to maintain equipment. Compromise the vendor and inherit their path into every customer.	Trusted access, no perimeter to cross

Threat actors, and what each one wants

Actor	Motivation	What it means for your defenses
Nation-state (APT)	Strategic sabotage, pre-positioning for future conflict	Patient, well-resourced, will spend months quiet. Detection matters more than prevention.
Cybercriminals	Extortion payouts	Opportunistic. Basic segmentation and backups defeat most of them.
Cyberterrorists	Public disruption and panic	Target visibility over value — water and power attract disproportionate attention.
Insiders	Grievance, or simple error	Bypass the perimeter entirely. An infected USB drive in a control workstation is the classic unintentional case, and it is far more common than sabotage.

The underlying vulnerabilities

• IT/OT convergence. Connecting plant systems to the corporate network for reporting exposes equipment that was previously unreachable. This is the single largest structural change in industrial risk over the past decade, and it was driven by business reporting needs, not by anyone deciding to accept the risk.
• Unencrypted legacy protocols. Many controllers lack the processing power for modern cryptography, so traffic can be read and forged. Encryption is not coming to these devices — the network around them has to carry the burden.
• Weak credential management. Hardcoded manufacturer passwords, shared operator accounts and no multi-factor authentication. Default credentials for most industrial equipment are published in the vendor's own manual.
• Removable media. Where the network is genuinely segmented, USB becomes the transfer mechanism — and therefore the infection path. Segmentation without a media control policy relocates the problem rather than solving it.

SCADA cyber security terminology

SCADA security, ICS/SCADA security and OT security are used more or less interchangeably in the market, and the distinctions matter mostly when writing a scope of work.

• SCADA refers specifically to supervisory control and data acquisition — the supervisory layer that monitors and controls a process.
• ICS (industrial control systems) is the broader family, including DCS, PLCs and safety instrumented systems. Most "SCADA cyber security" engagements are really ICS SCADA cyber security in scope.
• OT is broader again, covering building systems and any technology that interacts with the physical world. See OT security solutions.

Our SCADA security best practices follow IEC 62443 for architecture and NIST SP 800-82 for the control set, and a cyber security risk assessment for SCADA and DCS networks is scoped the same way regardless of which label the client uses. Security for SCADA systems is ultimately a segmentation and monitoring problem, because the endpoints themselves usually cannot be secured directly.

The recurring SCADA security issues we find are consistent across sectors: expired firewall exceptions left from a commissioning task, shared operator credentials, unmonitored vendor remote access, and controller logic with no verified backup.

IEC 62443 zones in practice

Level	Contents	Typical conduit
4–5 Enterprise	ERP, email, general IT	To DMZ only, authenticated
3.5 DMZ	Historian replica, patch server, jump host	Broker; ideally push-only from below
3 Operations	SCADA servers, engineering workstations	Inspected, protocol-aware
2 Supervisory	HMI, alarm systems	Cell-restricted
1 Control	PLCs, RTUs, DCS controllers	Within cell only
0 Process	Sensors, actuators	Physical
SIS	Safety instrumented systems	Separate. Never auto-isolated. Frequently air-gapped.

Worked example — discrete manufacturer, ransomware in the plant

An intrusion that began on corporate reached the plant supervisory network and encrypted two HMI workstations. Production stopped for 31 hours. We were engaged for recovery and then for the rebuild.

1. How it reached the plantA single firewall rule, added four years earlier for a vendor commissioning task and never removed, permitted RDP from a corporate subnet to the supervisory VLAN. This is the most common finding in OT intrusions and it is almost always an expired exception nobody reviewed.
2. Why it stopped where it didThe PLCs were untouched — not because they were protected, but because the ransomware had no Modbus capability. That is luck, and we said so rather than crediting the architecture.
3. RecoveryHMIs rebuilt from images. Controller logic was intact but there was no verified backup of it — the team's confidence that "the PLCs have the logic" held only because nothing had corrupted them.
4. Rebuild — conduitsEvery IT/OT rule re-derived from observed traffic. 34 existing rules reduced to 6, of which 2 were push-only from the OT side.
5. Rebuild — vendor accessReplaced with a brokered, time-boxed, recorded session requiring operator approval to open. Vendors disliked it; it was non-negotiable.
6. Rebuild — controller backupAutomated extraction and versioning of PLC logic with restore testing each quarter. They had operated for eleven years without this.
7. Rebuild — monitoringPassive sensors per cell with baselines from a full production cycle including changeovers.

Common questions

What is SCADA security?

SCADA security protects the supervisory control and data acquisition systems that operate physical processes in utilities, manufacturing and infrastructure. It differs from IT security because availability and safety outrank confidentiality, devices often cannot be patched or scanned, and a failed control can cause physical consequence rather than data loss.

What are the main SCADA security vulnerabilities?

Most commonly: flat networks with no segmentation between business and process systems, unauthenticated industrial protocols that were never designed for a hostile network, unpatchable controllers running long past vendor support, shared operator credentials, and remote vendor access paths that are neither monitored nor time-bounded.