The Relationship Between SCADA and Cybersecurity
SCADA systems, which stands for supervisory control and data acquisition, are critical to the industrial sector. By providing real-time information on equipment and operations, they remain integral as facilities move further and further into the automated world. Much like IoT and remote monitoring, SCADA is responsible for increasing efficiency. But it is also increasingly a target for cybersecurity threats.
SCADA and Cybersecurity Risk
Critical infrastructure has become a considerable playground for cyber criminals, including state-backed actors. Because they rely on SCADA as part of their network, protecting it is an incredibly important pursuit. “The greatest physical risk is to companies in sectors such as energy generation, which may rely on supervisory control and data acquisition (SCADA) systems. These are sophisticated control systems for complex machinery found in plants such as factories, oil pipelines, or even space stations, which in some cases were not designed to be connected to the internet,” as Kate O’Flaherty explains at IT Pro.
One example of an attack involving SCADA is an APT. This type of attack is characterized by its prolonged approach. With enough time, intruders can move their way from IT to OT systems, putting sectors such as pipelines at risk. Cybersecurity vulnerabilities posed to such systems has led to greater vigilance over necessary patches. Last month, Schneider Electric published two advisories detailing an EcoStruxure Machine SCADA Expert and Blue Open Studio vulnerability.
Preventing SCADA and Cybersecurity Risk
Considering the potential of vulnerabilities popping up, operators need to emphasize implementing cybersecurity solutions. One such recommended solution is network segmentation, or limiting the convergence between IT and OT where and when possible. This can happen with the help of tools like firewalls and VLANs (Virtual Local Area Networks).
Other solutions include conducting SCADA security assessments, meaning that operators thoroughly review the state of protections in place or needed. It’s also essential to continue to train current employees and future employees in the evolving cybersecurity landscape with a particular focus on SCADA and critical infrastructure.
Sources:
● “How to Improve Cybersecurity for SCADA Systems” - Zac Amos, Automation.com
https://www.automation.com/en-us/articles/february-2024/how-improve-cybersecurity-scada-systems
● “Cybersecurity threats in the pipeline industry: strategies for protection and mitigation” - Isabel Stagg, World Pipelines
● “Why attacks against critical national infrastructure (CNI) are such a threat – and how governments are responding” - Kate O’Flaherty, IT Pro
● “ICS Patch Tuesday: Advisories Released by Siemens, Schneider, Rockwell, Aveva” - Eduard Kovacs, Security Week