ICS/SCADA key terms

An umbrella term for the control systems that operate physical processes, including SCADA, DCS, and PLC-based systems. ICS environments prioritize availability, safety, and deterministic behavior over confidentiality.

Supervisory Control and Data Acquisition: a system that gathers telemetry from geographically dispersed field devices and lets operators issue supervisory commands from a central control room. It typically uses polling or report-by-exception over wide-area links.

A control architecture where controllers are distributed across a plant and connected by a dedicated network, usually serving a single contiguous process. It commonly integrates supervisory, control, and safety functions within one vendor ecosystem.

A ruggedized industrial computer that executes ladder logic or other control programs to read sensors and drive actuators in real time. PLCs are often reachable over the network and are a frequent target in ICS attacks.

A field device that collects data from sensors and sends it to a master station, and executes commands it receives back. RTUs are often deployed in remote or unmanned sites with intermittent communications.

The central component of a SCADA system that polls field devices, stores collected data, and presents it to operators. It also relays operator commands to RTUs and PLCs.

The graphical console or software through which an operator views process state and issues commands. Compromised HMIs give attackers a trusted foothold and a view of the physical process.

An independent control system designed to bring a process to a safe state when dangerous conditions occur. It is engineered to high reliability and should be logically separated from the basic process control system.

A reference architecture that divides industrial networks into hierarchical levels, from physical process at Level 0 up to enterprise IT at Level 4 and beyond. It guides where to place zones, conduits, and firewalls.

The automated transmission of measurements from remote field equipment to a monitoring location. In SCADA it usually means periodic readings of values such as pressure, flow, level, or status bits.

A communications scheme where a field device transmits only when a value changes beyond a defined threshold, rather than on every poll. It reduces bandwidth but can hide slow or steady-state tampering.

A request-response pattern in which the master station sequentially asks each field device for its current data. It gives predictable timing but scales poorly and reveals regular traffic patterns to an observer.

A widely used industrial protocol that exchanges simple register and coil reads and writes over TCP or serial links. It has no built-in authentication or encryption, so network segmentation and monitoring carry the security burden.

A master-outstation protocol common in electric and water utilities. It supports time-stamped events and optional secure authentication, but many deployments still run it without cryptographic protection.

The sequence of SYN, SYN-ACK, and ACK packets that establishes a TCP connection and synchronizes sequence numbers. Anomalies in this exchange can indicate scanning, spoofing, or injection attempts.

A layered description of network communication covering link, internet, transport, and application layers. Understanding it lets defenders reason about where a control protocol sits and where filtering can be applied.

A connectionless transport protocol with no handshake, ordering, or retransmission. Some industrial and discovery protocols use it, and its lack of state makes spoofing and reflection easier.

A buffer network placed between trusted internal networks and less trusted ones, holding shared services such as historians or jump hosts. In ICS it usually separates plant operations from enterprise IT.

Dividing a network into smaller zones with controlled paths between them, enforced by firewalls, routers, or VLANs. In industrial environments it limits how far an attacker can move from IT into process control.

A controlled communications path that connects two security zones and carries only explicitly permitted traffic. Conduits should be documented, minimized, and monitored rather than treated as trusted pipes.

Physical separation of a network from other networks so that no direct electronic connection exists. It blocks remote attacks but is bypassed by removable media, wireless links, or misconfigured dual-homed devices.

A one-way gateway that allows data to flow in a single direction, typically from a lower-trust network to a higher-trust one. It enforces directionality in hardware so that no return channel exists.

Deliberately creating a controlled data path across an otherwise isolated environment, for example with a diode, a jump host, or a scheduled replication process. Each bridge becomes a boundary that needs strict inspection.

Policies and technical measures governing USB drives and other portable storage, such as allowlisting, scanning, or blocking. These controls address one of the most common ways malware crosses an air gap.

The ongoing cycle of discovering assets, identifying weaknesses, prioritizing them by risk, remediating, and verifying. In ICS, patching windows are rare, so compensating controls often substitute for vendor fixes.

A public catalog that assigns unique identifiers to disclosed security flaws so tools and advisories can refer to the same issue. A CVE entry does not by itself describe severity or exploitability.

A framework for scoring the severity of a vulnerability using metrics such as attack vector, complexity, and impact. Base scores ignore local context, so ICS teams must adjust for process risk.

A safeguard used in place of the ideal fix when the preferred remediation is impractical, such as when a PLC cannot be patched. Examples include strict firewall rules, monitoring, and network isolation.

The process of testing, approving, deploying, and verifying software updates. In operational technology it requires vendor validation and planned outages, so updates often lag far behind IT.

A controlled process for reviewing, approving, documenting, and rolling back modifications to systems or configurations. In ICS it protects safety and availability from untested alterations, including security fixes.

A voluntary framework organized around Identify, Protect, Detect, Respond, and Recover functions. Organizations use it to structure and communicate their security program, and it maps readily to industrial environments.

A series of international standards addressing security for industrial automation and control systems. It defines security levels, zones and conduits, and requirements for asset owners, integrators, and product suppliers.

In IEC 62443, a measure of the protection a system can provide against a defined attacker capability, ranging from SL 1 to SL 4. Targets are chosen from risk assessment rather than applied uniformly.

Layering multiple independent controls so that failure of one does not expose the whole system. In ICS this spans physical security, segmentation, hardened hosts, monitoring, and tested recovery procedures.

A sensor that inspects network traffic or host activity and raises alerts for suspicious behavior. It is passive by design, so detection depends on placement, tuning, and someone acting on the output.

A device placed inline that can drop or block traffic judged malicious. In ICS, blocking can disrupt control traffic, so prevention is usually deployed with carefully tuned rules and fail-open planning.

Identifying attacks by matching traffic or activity against known patterns. It is accurate for known threats but blind to novel ones, and ICS protocol signatures require vendor-specific expertise.

Flagging activity that deviates from a learned or defined baseline of normal behavior. It can catch unknown attacks but produces false positives when legitimate operations or schedules change.

Examining packet payloads, not just headers, to identify protocols, commands, or malicious content. For ICS it enables command-level monitoring of protocols such as Modbus and DNP3.