SCADA Security
TIKAJ runs SCADA security assessments against the CPNI good practice guidance, with IEC 62443 and NIST SP 800-82 as reference points. We work passively first, reading traffic and configurations before touching a live controller.
CPNI Good Practices for SCADA Security
CPNI split process control security into seven good practices. We use them as the chapter headings for our scada security assessment services.
Understanding Business Risk
Start with the process. If the chlorine dosing pump stops for an hour, what happens downstream? The operators' answer sets the order in which findings get fixed.
Implement Secure Architecture
Where does the office network end? In many plants it doesn't, and a historian bridges both sides. We redraw the site as IEC 62443 zones and conduits and write firewall rules the operators will accept.
Establish Response Capabilities
A new laptop starts sending DNP3 commands at night. Would anyone notice? We look at what gets logged, who receives the alert, and whether the incident plan says when isolating a controller is safe.
Improve Awareness and Skills
Training built from your own findings. One shared engineering password on every HMI makes a better lesson than any slide deck.
Manage Third-Party Risk
Integrators like standing remote access, usually TeamViewer or a vendor VPN left on. We list each path and its owner.
Engage Projects
Retrofitting security after commissioning costs far more than writing it into the specification, so we review tender documents for new lines and upgrades.
Establish Ongoing Governance
After the report, somebody has to own this. Who signs off a change to ladder logic? How often is the asset register compared with what is really on the network?
Why SCADA Security Matters
Power grids, water treatment and manufacturing plants run on SCADA, and a compromise there can open a valve or trip a breaker rather than leak a spreadsheet. Things we usually check first:
- Remote access paths into the control network, and who holds them
- Whether the safety instrumented system shares a switch with the DCS
- Gaps against IEC 62443 or whatever your sector regulator cites
- Ransomware on the engineering workstations, which is far more common than sabotage
Our SCADA Security Approach
Work starts with a site walk and an asset list built from Wireshark captures, checked against the drawings. Then we read firewall rules and PLC project files and talk to the operators.
We scan actively only where you agree, often during a shutdown, since an Nmap sweep can still crash an older PLC. The worst finding is often mundane, such as an engineering laptop that browses the web and can also write to a PLC over Modbus.
Secure Your Critical Infrastructure
Tell us about the site and the control system vendor, and we will suggest a scope that does not put production at risk.