What is SCADA?

SCADA in plain English

SCADA stands for Supervisory Control and Data Acquisition. The term refers to systems that operators use to keep an eye on technical processes and steer them across long distances.

An everyday comparison: think of a big city’s traffic management center. On large screens, the staff can see where traffic is backing up, which traffic light has failed, and where a tunnel needs to be closed. They intervene from there without having to drive out to every intersection. A SCADA system does the same for pumping stations, electrical substations, or wastewater treatment plants.

SCADA is one type of industrial control system (ICS) and therefore part of operational technology (OT). That’s the term for technology that controls physical processes instead of processing data like traditional office IT.

How SCADA works

A SCADA system consists of several layers:

1. Sensors and actuators: Sensors measure values such as pressure, fill level, or temperature. Actuators such as pumps, valves, or switches carry out commands.
2. Field controllers: Programmable logic controllers (PLCs) and remote terminal units (RTUs) read the sensors, control the actuators, and transmit the data to the control center.
3. Communication network: The data travels over fiber optic cables, radio, cellular networks, or leased lines. Many industrial protocols – the “languages” devices use to communicate with each other – date back to a time when security was barely a consideration. In its original form, for example, the widely used Modbus protocol doesn’t verify the sender at all: a device executes commands without checking who sent them.
4. SCADA server: It collects all the data, detects limit violations, and triggers alarms.
5. User interface (HMI): In the control room, the human-machine interface displays the status of the facilities and accepts commands from the staff.
6. Historian: A database stores the process data over the long term, for example for analysis and documentation.

SCADA differs from the related distributed control system (DCS) mainly in its geographic reach: a DCS usually controls a plant at a single site, while SCADA connects facilities spread out over long distances.

A practical example

Here’s a typical scenario: A municipal water utility uses a SCADA system to monitor wells, elevated storage tanks, and pumping stations throughout its service area. Years ago, the plant engineering contractor set up a remote maintenance connection that is directly reachable from the internet and protected only by a password.

A security assessment reveals that this connection could be used to reach the user interface – and thus, in theory, to shut down a pump. The utility switches remote maintenance to an encrypted connection that is enabled only when needed. Signing in now requires a second proof of identity in addition to the password, known as multi-factor authentication. The utility also strictly separates the control network, where the control systems operate, from the office network.

Why does this matter for businesses?

An attack on a SCADA system threatens not just data but the supply of electricity, water, or heat – and, in a worst-case scenario, people and the environment. At the same time, many facilities stay in operation for decades. Their software often can’t simply be updated because a restart would interrupt operations or the manufacturer no longer provides updates.

In the past, many SCADA systems ran on largely isolated networks. Today, they are increasingly connected to office networks, cloud services, and remote maintenance access. That makes them easier for attackers to reach and puts them in the sights of both state-sponsored and criminal groups.

Many operators, for example in the energy and water sectors, are classified as critical infrastructure (KRITIS) in Germany and are subject to the BSI Act (BSIG) – the German law that governs the Federal Office for Information Security (BSI) and also implements the NIS2 Directive. The IEC 62443 series of standards often serves as a guide for securing these systems.

How to protect your organization

• Separate networks: Strictly separate the control network from the office network, and allow only explicitly required connections through a secured intermediate zone, a DMZ.
• Secure remote maintenance: Use encrypted access with multi-factor authentication, enable it only when needed, and log every session.
• Keep an inventory: Record all components, connections, and software versions – you can only protect what you know about.
• Harden systems: Change default passwords and disable services and interfaces you don’t need – what experts call system hardening.
• Detect anomalies: Monitor traffic on the control network so you can spot unusual commands or new devices early.
• Plan for emergencies: Have emergency plans ready – including manual operation in case the control systems fail.

How Rootsektor can help

With a penetration test for OT, ICS/SCADA & IoT, we assess SCADA servers, operator workstations, remote maintenance access, and the transitions between your office and control networks from an attacker’s perspective. The safe operation of your facilities is our top priority: we start passively and test controllers only with your explicit approval – for example, during maintenance windows or on a test setup. After scoping, you’ll receive a fixed-price quote – you can request it via our Pentest Quote page.