SCADA Networks Cybersecurity: Measures, Tools, and Intrusion Detection

This report provides an overview of Supervisory Control and Data Acquisition (SCADA) networks, emphasizing their critical role in managing essential infrastructure. It begins by defining SCADA, highlighting its importance and vulnerability to cyber threats, and then details the core elements of a SCADA system, including the Human-Machine Interface (HMI), Programmable Logic Controllers (PLC), supervisory systems, Remote Terminal Units (RTU), and communication infrastructure. The report then focuses on cybersecurity measures, such as identifying and securing SCADA network connections, disconnecting unnecessary connections, and hardening networks by removing unused services. It also explores intrusion detection tools and systems designed to identify and mitigate cyberattacks. The conclusion underscores the benefits of SCADA in automating processes and improving efficiency, as well as the importance of integrating SCADA networks for enhanced infrastructure management, supported by references to relevant literature.

INTRODUCTION:-
SCADA stands for Supervisory control and data acquisition networks. SCADA system contains
computers or various software which perform various critical tasks and provide all necessary
services within all critical infrastructure. All software are considered by the cyber strategists as a
backbone of every country. Critical infrastructure needs protection from many threats of cyber
that could affect their day to day operations in a large manner. (Matsui, 2014) SCADA system is
used for the purpose of the monitor all the key parameters related to a process of production. All
these systems designed solely for monitoring purpose without considering any type of security
requirements. SCADA system has a life cycle of various decades.
ELEMENTS OF SCADA SYSTEM FOR CRITICAL INFRASTRUCTURE NODE:-
SCADA system is a combination of different elements which are following:-
1. HMI
2. PLC
3. Supervisory System
4. RLU
5. Communication Infrastructure
1. HMI: - HMI stands for human-machine interface. HMI is an apparatus that is
managed by human beings for control and monitor various processes. It consists
visualization tasks which are closed to SCADA system as well as a machine. All
these tasks are very complex to perform.
1

2. PLC:- PLC stands for programmable logic control. PLC is used because the activities
performed in the organization are very flexible and most important it is very
economical than Remote Terminal Units. (Fovino, 2012) It is considered as a digital
computer which is utilized for making industrial processes more automatic. There are
following components that enable PLC work:-
 Rack and the power supply
 Central processing unit
 Section of input or output
3. Supervisory system: - It collects all the necessary data for processes and then sends
different control commands for all these processes.
4. RTU: - RTU stands for remote terminal units. This is the process which is linked to
sensors, and it converts the signal of the sensor in the digital data to SCADA system.
RTU is considered as a device which is installed at a location of remote. (Barbosa,
2012) It collects all the necessary information from a master device or implements all
the required processes which are directed by master devices.
5. Communication infrastructure: - it is a system of connecting supervisory system
with remote terminal units.
SECURITY MEASURES TO IMPROVE CYBERSECURITY OF SCADA:-
1. Identify all connections to SCADA networks:-
2

For measuring the risk related to the SCADA network, it is necessary to conduct a risk
analysis. It is necessary to develop a deep, comprehensive analysis of all SCADA
connections, which helps in giving the idea about how we can protect this network in a
proper manner. In it we identify or evaluate the following networks of SCADA:-
 Network related to the internal area or wide area.
 Network related to the internet
 Checking network related to satellite uplinks or wireless network devices.
 The modem of dial- up connections.
 Connections related to regulatory agencies, business partners or vendors.
2. Disconnect all unnecessary network connections of SCADA network:-
It is necessary to disconnect all the unnecessary connections related to SCADA network
so that it ensures the highest security of the SCADA network as much as it is possible.
Any other connection with SCADA network introduces new security risks, particularly
when the connections creates a pathway from an internet. (Akande,2015)It can be
possible that direct connection with other connections helps more in passing the
information effectively. First motive should be for anyone to protect SCADA from
different risks.
3. Evaluate and strengthen the security of any remaining connections related to
SCADA network:-
3

It should be necessary to conduct penetration testing or analysis of vulnerability for any
remaining connections of the SCADA network. For securing the SCADA network, it is
necessary to implement firewalls and other security measures.
4. Harden SCADA networks by removing all unnecessary services:-
As much as it can be possible, all unused services should be removed immediately. This
reduces the risk related to network daemons. This is very important to perform if SCADA
network is interlinked with various other networks. It is necessary not to give any permit
to any other services unless risk associated with that service is measured.
TOOLS TO DETECT INTRUSION IN SCADA NETWORK:-
It is one of the important tasks for the cyber security to prevent intrusions into one database or
the system. It is necessary that intrusions should be detected if it occurs. A new program or
modification of the computer code helps the intruder in preventing intrusions. An intruder is a
person who gains control of substation computer. (Akande, 2015) New established software
could be programmed to gather data very speedily or for sending the data to the intruder when it
is required. (Matsui, 2014) As it is considered necessary to detect intrusions, for this purpose
various manufacturer of IT security system have developed intrusion detection system (IDS).
This system is a combination of different factors which are following:-
 All type of communications which is attempted from unusual and unauthorized
addresses.
4

 The unusual pattern which is related to a different activity.
These factors generate logs related to different suspicious events. Then the owner of the whole
system inspect all these factors manually and then find out which factors are determining true
intrusions or which are false.
CONCLUSION:-
After studying all this, we can conclude that reevaluation of the infrastructure of the power plant
can be done easily by using SCADA network without facing any hurdles. While evaluation of
the power plant everyone can face different problems like - a size of the plant and its complexity,
no any justification for continuity of operations and lack of the sophisticated system for
monitoring efficiency. All these are solved by the proper implementation of SCADA network.
Following SCADA system brings automation in our technology or bring efficiency in all its
operations. SCADA is very flexible and reliable in implementation which makes every task very
easy. Adopting SCADA network proves very cost efficient because in the implementation of the
SCADA network not any other charges beard by power plant organization. Now it can be very
useful for all the power plants that the government of India also decided to integrate all state
power networks till 20111 with SCADA network. So, it will be very helpful in the revaluation of
the infrastructure of a power plant by using SCADA network.
5

REFERENCES:-
Fovino, I. N., Coletta, A., Carcano, A., & Masera, M. (2012). Critical state-based filtering
system for securing SCADA network protocols. IEEE Transactions on industrial
electronics, 59(10), 3943-3950.
Barbosa, R. R. R., Sadre, R., & Pras, A. (2012, April). A first look into SCADA network traffic.
In 2012 IEEE Network Operations and Management Symposium (pp. 518-521). IEEE.
Akande, A. J., Fidge, C., & Foo, E. (2015, January). Component modeling for scada network
mapping. In Proceedings of the 38th Australasian Computer Science Conference (ACSC
2015) (Vol. 159, pp. 91-100). Conferences in Research and Practice in Information Technology
(CRPIT).
6

Matsui, Y., Kojima, H., & Tsuchiya, T. (2014, January). Modeling the Interaction of Power Line
and SCADA Networks. In 2014 IEEE 15th International Symposium on High-Assurance
Systems Engineering (pp. 261-262). IEEE.
7