What is SCADA

SCADA Security: Protecting Process Automation Systems

SCADA is an acronym that stands for Supervisory Control and Data Acquisition. It is a common process automation system that collects data from remote sensors and sends it to a central location for control or monitoring (Igure, Laughter & Williams, 2006). The collected data is examined on SCADA host computers, and orders can be sent to field devices depending on this information. Sensors, conversion units, master units, and communication networks comprise a SCADA system. SCADA systems are used to manage infrastructure like water, telecommunications, oil and gas refineries, and nuclear power facilities. SCADA was created for the express purpose of monitoring; consequently, security was not a vital component. The systems are therefore at the risk of cyber insecurity. There are also physical threats that SCADA security systems face.

Physical Threats to SCADA Systems

There have been several cases of physical threats compromising SCADA systems. An example is a case of an insider jeopardizing the system from within the company. It could be a member of staff who is dissatisfied with the working conditions and wants to compromise the system. Since it is a member of staff, they know the system and have clearance to access it thus making their malicious plans possible. One such reported incident was the case of Vitek Boden who accessed the controls of the sewer system of Moorochy Shire County Australia. He was the onsite supervisor for a contractor who was installing a SCADA system for the sewer system. After the job was done and he resigned and could not be hired again. Soon after, the system started experiencing malfunctions. They included loss of communications, alarms being turned off and raw sewage being released. He was able to do all this from his car with a laptop, a data radio, and a local processor.

Terrorism and SCADA System Threats

Another threat to SCADA system is terrorism. The aim of such an attack would be to disrupt the monitoring and control capabilities of the system, take control of them and feed the system false information. The attack could also be carried out to damage the physical infrastructure controlled by the system. Al Qaeda has been reported to be involved in such attacks. Some of their members are highly skilled in SCADA systems and even went to engineering school. They could compromise telecommunication during an attack to ensure that communication in and out of the area of attack is impossible.

Human Error: A Costly Threat to SCADA Systems

Human error can be a very costly threat to SCADA systems. The error can be accidental such as entering the wrong value or due to a new employee. Such failure could damage the system or unintentionally change processes. Inserting an infected USB drive on the SCADA computers can also have devastating results. One of the dire consequences of human error would be nuclear explosions; this can happen if the wrong data is keyed in which could lead to overheating and thus an accidental explosion. Such a thing would have massive repercussions including loss of life and property. To ensure minimal human error, all employees should be properly trained. There should also be strict regulations regarding the handling of SCADA computers.

Presidential Policy Directive 21: Improving Cyber Infrastructure Security

The presidential policy directive 21 (ppd 21) is an Executive order that was issued by President Barrack Obama aimed at improving resilience and security of cyber infrastructure from both physical and cyber threats (Yates, 2016). When it comes to the secure functioning and resilient critical infrastructure, there should be a policy on access to data. There should be clear and concise stipulations on who has access to information and offices that house the computers used in monitoring and control of security systems. The policy should be implemented in all companies involved in critical infrastructure. Those employees with clearance should be adequately trained. They should also be held accountable for mishaps in the security systems.

Resilient Infrastructure: Protecting from Natural Disasters

Resilient infrastructure is infrastructure with the ability to withstand disturbance and still be able to retain its core functionality and structural capacity (Biggs, Ryan & Wiseman, 2010). The concept of resilient infrastructure was introduced following natural disasters to protect people and property in the event of future occurrences. It can be done by creating an inventory map with amenities within high-risk areas. It will make it possible to know which areas are most affected by interruptions and how to handle the human population in those areas. The age of the infrastructure in those areas should also be considered. Another way that the concept of resilient infrastructure helps protect people and property is by visualizing potential impacts on the area should the sea level rise. Doing this ensures that the population living around danger zones is forewarned and that the infrastructure around the area is built to withstand the elements.

Conclusion

Cyber security is an area of concern. Measures should be put in place to ensure that infrastructure that is run using the internet is safe. Infrastructure should also be protected from physical threats and natural disasters. Policy should be put in place and implemented to ensure that network systems are safe from compromise.

References

Biggs, C., Ryan, C., & Wiseman, J. (2010). Distributed Systems: A design model for sustainable and resilient infrastructure.

Igure, V. M., Laughter, S. A., & Williams, R. D. (2006). Security issues in SCADA networks. Computers & Security, 25(7), 498-506.

Yates, S. (2016). National Critical Infrastructure Policy (1st ed.). Hauppauge: Nova Science Publishers, Inc.