cybersecurity concerns SCADA cloud systems


A security checklist for SCADA systems in the cloud

Given the critical nature of operations that supervisory control and data acquisition (SCADA) systems manage, an article containing the words “cloud,” “SCADA” and “vulnerabilities” together should raise the hair on the necks of information security professionals.

Traditionally, SCADA applications used to control critical infrastructure have been hosted within an organization’s IT infrastructure and have relied on the protection offered inside the infrastructure perimeter. In some cases, organizations have “air gapped” their SCADA applications from the broader network and particularly from the Internet. 

Today, organizations have recognized the advantages of cloud-based computing and are migrating their SCADA applications into the cloud environment to reduce costs, gain efficiencies and increase reliability. Because it is still relatively new, we have yet to see many cyberattacks on cloud-based SCADA systems, but that is sure to change with time. More troubling, however, is that attacks against cloud-based SCADA applications can be disproportionately harmful because of their criticality.

Considering the risks

Before moving SCADA applications to the cloud, the security risks must be considered with eyes wide open. Although cost reduction and increased efficiency are significant business drivers, so too is security. The impacts of data loss/compromise, loss of organizational control and denial of service should be balanced against the advantages of cloud-based SCADA hosting. Organizations must establish their risk tolerance and their level of comfort with giving up the control they may currently exercise through internal IT infrastructure hosting.

The importance of vulnerability management with cloud-hosted SCADA systems is paramount. So is consideration of the security flaws inherent in current SCADA protocols. For instance, Modbus and DNP3 – today’s most common SCADA protocols – do not support or perform authentication and encryption.

Correction: DNP3 does support support authentication.  See comments below for additional details.

Consequently, organizations must be able to continually monitor vulnerabilities in security controls protecting SCADA applications and ensure their ongoing remediation. SCADA systems need to be treated differently than most other IT systems, and the timeframe for mitigation of vulnerabilities is much shorter. Acceptance of risks in SCADA system controls should approach zero.

The results of this risk assessment should provide the data needed for a sound decision about moving SCADA applications to the cloud. If information security risk is evaluated the same way as cost, efficiency and reliability needs, then a cloud migration decision will be on solid footing.

After an organization decides to proceed to the cloud, it will need to identify a service provider.

Any cloud provider must be able to satisfy security controls requirements. For SCADA applications, there must be high assurance that the provider can demonstrate the ability to provide and maintain strong security mechanisms and processes. The following areas should be considered when evaluating cloud provider capabilities.

  1. Data separation. Confirm that the provider can segregate customers’ data and applications from each other.
  2. Infrastructure control. Determine how much control customers have over changes to the provider’s infrastructure. For instance, clients should be alerted when updates to the back-end infrastructure are made and when new third-party connections are initiated.
  3. Encryption. Ensure the cloud provider can encrypt data at rest.
  4. Patching. Determine the provider’s ability to automatically patch known vulnerabilities at a rate consistent with organizational policy.
  5. Reporting. Determine if the provider is able to provide standard and ad hoc reports that satisfy business needs.
  6. Continuous monitoring. Confirm that the provider has a continuous monitoring capability that includes automated and manual near-real-time assessments of the effectiveness of security controls.
  7. Situational awareness. Ensure there is a capability for capture and analysis of all log data and real-time detection, response and analysis of events, incidents and suspicious or abnormal activities.
  8. Remediation. Understand the provider’s commitment to immediate corrective action of all vulnerabilities identified.
  9. Staffing. Determine the availability of sufficiently trained, dedicated security staff.

The most effective means of ensuring the protection of a cloud-based SCADA application is to negotiate an effective, measurable service level agreement that covers the above areas. Paying a premium for delivery of secure cloud-based services at this level is probably justified, considering the risks involved.

Migration of SCADA applications to the cloud is a relatively new business strategy that warrants caution. While increases in savings and efficiency are undeniable, the criticality of SCADA systems justifies a “go slow” approach until there is assurance that the cloud provider can secure critical business data.

About the Authors

Patrick D. Howard, of Kratos Technology & Training Solutions, was lead author of this peer-reviewed article.

Members of the (ISC)2 U.S. Government Advisory Council Executive Writers Bureau include federal IT security experts from government and industry. For a full list of Bureau members, visit

inside gcn

  • cloud video processing

    Sprocket kicks video processing into high gear

Reader Comments

Wed, Jul 1, 2015 Patrick Howard

Author’s Note: My research for this article failed to uncover the good work that has been done by the DNP3 Users Group. Thanks Jacob for reporting the progress made to improve DNP3 authentication, and I stand corrected. PDH

Tue, Jun 30, 2015 Jacob Brodsky, PE Maryland

Mr. Howard's statement that DNP3 does not support authentication is not current information. In fact, the DNP3 Users Group has and continues to work on Secure authentication features for more than a decade. It has been a published part of the DNP3 standard since IEEE Std. 1815 in 2010 and was later updated and improved in 2012. The DNP Users Group has conducted plug-fests and has worked in conjunction with the Electric Power Research Institute (EPRI) to develop multi-vendor support for these features. For further details, please see the web site. Jacob Brodsky, PE Chair, DNP Users Group

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group