Overcoming SCADA integration cybersecurity challenges

SCADA cybersecurity insights

• Implementing SCADA systems requires robust security measures, including strong authentication, access controls, encryption, firewalls, and intrusion detection systems to safeguard against hacking and unauthorized access.
• Beyond external threats, SCADA systems need protection from internal risks, such as employee errors or malicious insiders. Role-based access controls, user activity monitoring, and comprehensive policies are essential to minimize internal vulnerabilities.
• Control engineers play a crucial role in ensuring the security of SCADA systems. Key steps include thorough risk assessments, defense-in-depth strategies, regular software updates, secure remote access solutions, employee training, and awareness programs to address the complexity of cybersecurity.

Supervisory control and data acquisition (SCADA) systems are attractive targets for cyber-attacks because of their role in controlling and monitoring critical infrastructure such as power plants, water treatment facilities, and transportation systems. SCADA systems are vulnerable to a variety of security threats, including hacking, viruses, worms, and denial-of-service attacks.

According to a Horner engineer, one of the most complex security challenges in implementing SCADA systems is ensuring that the system is secure against unauthorized access. “This necessitates the use of strong authentication and access control mechanisms, as well as encryption, to protect data in transit and at rest. To prevent unauthorized access and detect security breaches, firewalls and intrusion detection systems are also essential,” the engineer said.

There is also a need to protect systems from internal threats such as malicious insiders or employee errors. This necessitates the implementation of role-based access controls, the monitoring of user activity, and the implementation of policies and procedures to ensure that employees understand their security responsibilities.

Horner’s advice to control engineers to overcome security challenges when implementing a SCADA system is to develop and use strong security measures, such as firewalls, intrusion detection systems, and access controls. Regular security audits and employee training will also help ensure that security risks are identified and addressed as soon as possible.

Benefits of a secure SCADA system

A secure SCADA system will deliver a wide range of benefits for control engineers, helping to ensure system uptime, reliability and availability. However, according to Mazhar Hussain, digital solutions leader – UK & Ireland at Schneider Electric, achieving all these benefits does require commitment from the entire organization.

“Implementing a strong cyber strategy will ensure a trusted system. The responsibility for achieving this should be shared across vendors, system integrators, and IT, but control engineers can also take direct steps to solve integration challenges. Once a risk assessment is complete and has taken into account the specific vulnerabilities of the SCADA system, control engineers must adopt the security policies traditionally held solely by IT,” he said.

Because SCADA systems integrate with corporate networks and the Internet, new potential breaches will be opened up if procedures are not put in place for both networks. Mazhar went on to explain that control engineers who examine systems remotely need encryption or authentication mechanisms to ensure the integrity of transmitted information.

Mazhar said, “Control engineers should implement continuous monitoring mechanisms to regularly audit and review the effectiveness of SCADA security, potentially mitigating security breaches before they lead to downtime. That same level of evaluation should also apply towards vendors, so always opt for vendors that follow best practices for cyber security and provide regular updates to address new vulnerabilities.”

Five steps for secure SCADA software systems

Gunnar Lanz, Marketing Manager for SCADA software at Siemens, agrees about the importance of the control engineering role in ensuring secure operations. He said, “It is crucial for control engineers to prioritize the implementation of robust security measures.” He suggested some key steps that should be taken to overcome cybersecurity challenges when integrating a new SCADA solution. These include:

1. Conduct a thorough risk assessment: Before integrating any new SCADA solution, control engineers must conduct a comprehensive risk assessment to identify potential vulnerabilities and threats. This assessment should include evaluating the existing infrastructure, analyzing the potential impact of a cyber-attack, and understanding the criticality of each component.

2. Implement a defense-in-depth strategy: A defense-in-depth strategy is essential for protecting SCADA systems from cyber threats. It involves implementing multiple layers of security controls to ensure that even if one layer fails, other layers are still intact. One important layer is system integrity – to protect automation systems and controllers, SCADA systems and HMI systems against unauthorized access or to protect the know-how contained therein. Ensuring system integrity also comprises user authentication and their access rights as well as system hardening against attacks. To implement a comprehensive defence-in-depth approach, control engineers should consider incorporating various security measures such as firewalls, intrusion detection systems, access controls, and encryption.

3. Keep software and firmware up to date: Outdated software and firmware can pose serious security risks. Establish a process for regular updates and patches to keep SCADA systems protected against known vulnerabilities. This process should also include a mechanism to identify and address security vulnerabilities in third-party components.

4. Secure remote access: Many SCADA systems require remote access for maintenance or troubleshooting purposes. Control engineers should implement secure remote access solutions, such as virtual private networks (VPNs) and two-factor authentication (2FA), to ensure only authorized personnel can access the system remotely. It also is advisable to limit remote access privileges to essential personnel only.

5. Employee training and awareness: The human element is often the weakest link in cybersecurity so do provide regular training and awareness programs for all employees involved in the SCADA integration.

No simple answer

Steve Ward, EMEA director of application engineering, controls & software at Emerson, pointed out that cybersecurity is a complex subject with no simple answer. “Emerson’s approach is defense in depth, which applies cybersecurity measures at multiple levels,” he said.

This defense needs to start at the physical layer, which can include details like the network architecture and firewalls, and also covers issues like physical access to equipment. “A standard rule of computing is that if someone has access to the device, they can own it, so measures like putting devices in a secure cabinet with a physical lock and limiting access should not be overlooked,” Ward said. “Firewalls are also important, and the network layer should be designed so that there are firewalls at multiple levels.”

When it comes to cybersecurity, control engineers tend to focus on the hardware and software of the system, but Steve argued that operators also need to be considered. He said: “The end user should treat SCADA along with other computer applications like e-mails and office software and make sure that operators have training and understand what their responsibilities are. As part of an organizations’ approach to IT, processes and procedures will be created, such as password complexity rules – these should be applied to SCADA, too.

“Integrating SCADA security into the corporate domain, using Microsoft Active Directory or similar, can be a simple way of enforcing this, as well as synchronizing passwords so that users do not have to remember logins to multiple devices. The system should be designed on the basis of least privilege, with multiple access levels and the highest levels such as administrators only assigned to essential personnel.”

While equipment will always be chosen based on the needs of the application, this should now also include cybersecurity as a requirement.

“Modern hardware and software tend to be more secure than older items, however new and additional features can introduce their own risks,” Ward said. “Equipment with cybersecurity approvals are preferred but lack of approvals doesn’t mean equipment is not suitable, and the presence of approvals doesn’t mean that equipment is secure out of the box. All equipment that is installed needs a review and unused ports and software capabilities should be turned off or disabled. The vendor should also be reviewed and vendors that have a secure supply chain along with secure development processes are preferred.”

Cybersecurity is a constantly moving target. Hardware and software need regular patching and security updates should be applied as soon as possible after they are released, although testing is recommended on a test system before deploying to production. Legacy hardware that can no longer be updated may need to be replaced by newer equipment. Old operating systems may need to be updated to later operating systems, in turn requiring that application software is updated to later versions. Choosing a SCADA vendor with a proven approach to modernization with incremental updates can be helpful as otherwise a point may be reached when a costly rip and replace project is required to update the system and keep it secure.

– This originally appeared on Control Engineering Europe. Edited by Chris Vavra, web content manager, CFE Media and Technology, cvavra@cfemedia.com.

Do you have experience and expertise with the topics mentioned in this content? You should consider contributing to our WTWH Media editorial team and getting the recognition you and your company deserve. Click here to start this process.