SCADA

What is SCADA?

SCADA stands for Supervisory Control and Data Acquisition: a control system architecture for monitoring and controlling processes that are spread over a large area from a central control room. Power grids, water and wastewater networks, gas pipelines, district heating and railway infrastructure run on SCADA. Operators see the state of the whole network on their screens, receive alarms and send commands such as opening a breaker or starting a pump.

A SCADA system has a central SCADA server (often called master or MTU), HMIs for the operators, a historian that stores process data, and field devices at the outstations: remote terminal units (RTUs) and PLCs that read sensors and drive actuators. Control room and outstations are connected over leased lines, radio, cellular and increasingly plain IP networks. The typical protocols are IEC 60870-5-104 in European energy and water utilities, DNP3 (IEEE 1815) in North America, Modbus everywhere, IEC 61850 inside substations and OPC UA towards enterprise systems.

Where is it defined?

SCADA is an architecture, not a standard. NIST SP 800-82 Rev. 3 describes SCADA, DCS and PLC-based systems and their security; IEC 62443-1-1 provides the terminology and places SCADA in the industrial automation and control system model. The protocols have their own standards: IEC 60870-5-104 for telecontrol over TCP/IP, IEEE 1815 for DNP3, and the IEC 62351 series for securing power-system protocols with TLS and application-layer authentication. For operators, SCADA falls under NIS2 Article 21 and, in Germany, under the KRITIS rules of the BSIG; the SCADA products themselves fall under the Cyber Resilience Act.

What it means in practice

Typical findings in SCADA environments, from utilities to industrial sites:

• Control room on the office domain. SCADA servers and HMIs are joined to the corporate Active Directory, so a phishing mail in the office is one hop from the control room.
• Shared operator accounts. HMIs run with one account that has never been changed because a logout would blank the screens.
• Unauthenticated telecontrol. IEC 60870-5-104 and DNP3 accept commands from any host that reaches port 2404 or 20000; the secure authentication extensions are not enabled because the RTUs do not support them.
• Outstations on the internet. Cellular modems and routers at remote sites with default passwords, reachable from the internet and visible in search engines for connected devices.
• Web HMIs with web vulnerabilities. Modern SCADA products ship browser-based HMIs, and they have the same injection, authentication and session problems as any web application. We test them as web applications, in a test environment.
• Historian as bridge. The historian database is reachable from the office network for reporting and, from there, from the control network.

Testing a SCADA system follows OT rules: passive capture of the telecontrol traffic first, configuration review of servers and firewalls, active tests only against test or staging systems, and no write commands to live outstations. Zyberum tests SCADA environments and the web and backend components around them, analyses RTU and PLC firmware in the lab, and monitors control networks with the Zyberdome managed SOC.

Common misunderstandings

SCADA is not a synonym for all industrial control; it is the supervisory layer. “Proprietary protocols protect us” is false: Wireshark dissectors and open-source clients exist for every common telecontrol protocol. And a SCADA network is not isolated because the diagram says so; the maintenance connection, the historian link and the cellular routers are the paths that attackers actually use.