SCADA, supervisory control and data acquisition, is software and equipment that lets operators monitor and control physical processes such as electricity distribution, water treatment and pipelines from a central point. Securing it means protecting safety and availability first, with segmentation, controlled remote access and a rehearsed manual fallback.
What is SCADA, and how does it fit with OT?
NIST SP 800-82 Rev. 3 is the main US guide. It covers operational technology (OT), meaning programmable systems and devices that interact with the physical environment or manage devices that do. It lists examples including industrial control systems, building automation, transportation systems and physical access control. SCADA is one family of industrial control system. A typical one has field devices such as sensors and controllers, a communications network, and a control center where operators watch and issue commands.
NIST says the guidance addresses OT's unique performance, reliability and safety requirements. That is the key difference from ordinary IT. A reboot that is trivial for an office server can disrupt a physical process. Patching windows are rare. Equipment may run for decades, and availability and safety take priority over confidentiality.
What do real incidents show?
Two government records show common weak points.
In the 2015 Ukrainian power outages, ICS-CERT reported that operators were locked out while external humans opened breakers using remote administration tools or industrial control client software over VPN connections, probably with credentials acquired earlier. Systems were then wiped with KillDisk malware. About 225,000 customers were affected.
In the 2021 pipeline ransomware case, CISA and FBI said ransomware hit the company's IT network, with no indication that OT networks were directly affected, and the company reported proactively disconnecting some OT systems. The advisory recommends strong segmentation between IT and OT, testing manual controls, and keeping isolated, tested backups.
Together they show two things: remote access is a prime route in, and an IT incident can force an operational shutdown even when the control system is untouched.
What are the main controls?
Segmentation. Separate IT from OT, and divide OT into zones, with firewalls and tight rules between them. Allow only what the process needs.
Remote access. Require multi-factor authentication, use dedicated jump hosts, limit by time and person, and log sessions. Avoid vendor access that is permanently open.
Inventory. Know every controller, workstation, protocol and connection. You cannot defend what you cannot list.
Hardening. Disable unused services and ports, change default passwords and use application allow lists on operator stations. These are low cost steps that follow the least functionality principle.
Monitoring. Passive network monitoring that learns normal traffic and flags changes is often safer in OT than active scanning, which can disturb fragile devices.
Patching with care. Test patches on a replica first and schedule them for maintenance windows. Where you cannot patch, use compensating controls such as isolation.
Backups and recovery. Keep offline copies of controller configurations and project files, and practice restoring them.
Manual operations. Rehearse running the process manually, as CISA recommends, so a decision to disconnect IT does not become a decision to stop.
A constructed example
A small water utility has a control room, a handful of controllers at pump stations and a cellular link to each. Its inventory shows an engineering laptop that also browses the internet and a vendor modem that is always on. The plan: put the control network behind a firewall with only the needed protocols allowed, replace the always-on modem with a vendor access process that needs approval and multi-factor authentication, dedicate the laptop to engineering work, store offline copies of controller programs, and run a quarterly drill where operators run the pumps manually for an hour.
How to check or apply this
- List all OT assets and every connection into and out of them, including vendor and cellular links.
- Draw the boundary between IT and OT, and verify that rules at the boundary are as narrow as they should be.
- Review remote access: who, how, when, with what authentication.
- Back up controller configurations offline and test a restore.
- Rehearse manual operation and agree who can order a disconnect.
- Read NIST SP 800-82 Rev. 3 for your sector and map its recommendations to your gaps.
Quick check
Is SCADA the same as OT?
No. OT is the broader category. SCADA is one type of industrial control system within it.
Can I run a normal vulnerability scanner on SCADA networks?
Be cautious. Active scans can disrupt fragile devices. Use passive monitoring or test in a replica, and coordinate with operations.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA ICS-CERT, IR-ALERT-H-16-056-01, Cyber-Attack Against Ukrainian Critical Infrastructure
- CISA, AA21-131A, DarkSide Ransomware: Best Practices for Preventing Business Disruption
The description of SCADA components and the list of hardening steps are general practice. NIST SP 800-82 gives sector specific detail.
Last reviewed: 18 October 2026.
