Strategies for Protecting Traditional SCADA Systems Against Cyber Threats

[Ahmet Ö.]

## Cybersecurity Strategies for Traditional SCADA Systems

SCADA (Supervisory Control and Data Acquisition) systems emerged in the 1970s for real-time data monitoring and process control. Since then, they have become an indispensable part of automation in discrete manufacturing and processing industries. However, these systems, designed for that era, are vulnerable to cybersecurity threats in today's increasingly interconnected world.

Experts Alberto Rivi (Emerson), Noel Henderson (Schneider Electric), and Michael Metzler (Siemens Digital Industries) shared important insights on the vulnerabilities encountered in existing SCADA systems and the measures that can be taken against them.

### Common Security Vulnerabilities in SCADA Systems

• Systems designed to operate in isolated environments in the past often lack encrypted communication and role-based access control.
• They cannot integrate with current IT security solutions and do not receive regular security patches.
• Due to high replacement costs, many organizations remain dependent on old SCADA systems, risking outdated software, weak authentication, insecure communication protocols, and inadequate network segmentation.
• These systems are often connected to corporate networks or the internet, creating a breeding ground for malware activities.

### How to Assess the Security Posture of SCADA Systems?

• Risk analyses should be conducted to determine the current security status, based on IEC 62443 or NIST standards.
• A SCADA asset inventory should be created, and old software versions and access permissions should be reviewed.
• Passive network scanners can be used to map system traffic and protocols without causing harm.
• Detailed vulnerability analysis for IEC 62443 compliance can be performed with certified third-party experts.

### Network Segmentation and Isolation Strategies

• SCADA systems should be isolated into separate subnets, and external access should be controlled.
• Unidirectional data diodes can be used to prevent interference with the system while enabling data transfer.
• Industrial firewalls should limit access from both the corporate network and external connections.
• Each production cell should be segmented using VLANs and micro-segmentation methods.

### Multi-Factor Authentication (MFA) Implementations

• If older systems do not support MFA, user-based security measures can be applied at the network access layer.
• Access logs are maintained by matching users' unique access rights with firewall rules.

### Indicators of Compromise and Monitoring

• Unexpected protocol traffic, abnormal commands, failed login attempts, and unusual connections should be monitored.
• Changes in system configurations, user accounts, and access permissions can indicate malicious activities.

### Alternative Protection Methods for Systems That Cannot Be Updated

• Multi-layered defense principles and network isolation compliant with IEC 62443 standards should be implemented.
• Communication should be secured with VPN and encryption technologies.
• Intrusion detection and prevention systems adapted for OT environments should be used.
• The Zero Trust principle should be adopted to secure cloud and remote connections.

### Prioritization and Modernization Planning

• Risk assessments should be conducted to prioritize the protection of critical and high-risk SCADA systems.
• Considering update costs, gradual modernization and security improvement roadmaps should be prepared.
• Monitoring and logging infrastructure should be adapted to the requirements of modern SCADA systems.

### Sectoral Differences and Threat Landscapes

• The manufacturing sector is one of the most targeted areas for industrial attacks, with attacks increasing by 300% since 2020.
• The electricity and oil-gas sectors are the riskiest sectors, potentially leading to critical infrastructure outages in the event of successful cyberattacks.

Ensuring the security of SCADA systems requires not only technical investments but also organizational culture and continuous update strategies. It is recommended to seek support from expert partners in this field.