Lead SCADA Security Manager cheat sheet

Purdue model levels: 0 physical process, 1 controllers (PLC/RTU), 2 supervisory (SCADA/HMI), 3 site operations, 3.5 DMZ, 4 enterprise, 5 external; conduits between levels must be controlled and monitored.

SCADA availability-first ordering: safety, availability, integrity, confidentiality; IT ordering (CIA) is inverted, so control selection must not trade process availability for confidentiality gains.

IEC 62443 zones and conduits: group assets sharing security requirements into zones, then define conduits with allowed protocols, direction, and inspection point; reference model in IEC 62443-3-2.

Security Levels SL1-SL4 (IEC 62443-3-3) apply to systems, target SL (SL-T) derives from risk assessment, achieved SL (SL-A) from verification; capability SL (SL-C) is vendor-claimed.

Modbus TCP and DNP3 have no native authentication or encryption; compensating controls are network segmentation, deep-packet inspection at the conduit, and protocol-aware anomaly detection.

IEC 61850 GOOSE and SV messages are Layer 2 multicast with tight latency budgets; encryption or added latency is generally infeasible, so isolation and MAC/frame filtering are the controls.

Passive network monitoring (SPAN/TAP, unidirectional gateways) is preferred in Level 0-2 because active scanning can crash fragile controllers and disturb real-time loops.

Known ICS attack classes: Stuxnet (air-gap crossing via removable media), TRITON (safety instrumented system targeting), Industroyer (grid protocol abuse), PIPEDREAM/INCONTROLLER (toolkit for PLC manipulation).

Default and shared credentials on HMI, engineering workstations, and network gear are a leading initial-access vector; asset inventory with firmware versions is prerequisite to patching decisions.

NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover; Govern was added in 2.0 and covers risk strategy, roles, policy, and supply chain.

Program maturity models: C2M2 (10 domains, MIL0-MIL3) for energy and critical infrastructure; IEC 62443-2-1 for asset-owner security management systems.

Risk = likelihood x impact; ICS scoring must weight physical consequence (safety, environmental release, production loss) alongside data loss.

Incident response for OT requires a manual fallback plan: defined safe-state procedures, operator runbooks, and tested ability to run the plant without SCADA for a stated duration.

Change management for OT: every controller or HMI change passes through a maintenance window, rollback plan, and post-change verification; unmanaged changes are a top audit finding.

Tabletop exercises should include operations, engineering, IT security, and physical security; a tabletop that never reaches the 'safe state' decision is incomplete.

Metrics that matter: mean time to detect OT anomalies, percentage of OT assets in monitored zones, patch latency for critical PLC firmware, and number of shared accounts remaining.

Third-party risk: vendors with remote access need time-bound, logged, MFA-protected jump-host sessions; standing VPN access to Level 2 is a control failure.

Defense in depth layers for SCADA: perimeter firewall, DMZ with replicated data (historian mirror), zone firewalls, host hardening, application allowlisting, and physical access control.

Unidirectional gateways (data diodes) allow telemetry out of the control zone with no return path; they replace bidirectional firewall rules where the business only needs to read data.

Network segmentation rule: no direct routing between Level 3.5 DMZ and Level 2; all traffic terminates at a proxy or broker in the DMZ.

Identity controls: unique accounts per engineer, MFA at remote access and jump hosts, privileged access management vaulting for controller and switch credentials.

Cryptography: TLS 1.2+ for northbound flows, no reliance on outdated ciphers; where legacy devices lack TLS, terminate at a protocol-aware proxy rather than weakening the tunnel.

Logging: forward Windows event logs, firewall logs, and IDS alerts to a SIEM; retain per policy and include OT-specific sources such as PLC change events and engineering workstation USB activity.

Vulnerability management in OT: prioritize by exploitability and process exposure, not CVSS alone; a CVSS 9.8 on an unreachable engineering tool ranks below a CVSS 6.0 on an internet-facing HMI.

Backup integrity: configuration backups of PLCs, HMIs, and switches must be stored offline, versioned, and restore-tested; ransomware recovery depends on this more than on detection.

Regulatory landscape for critical infrastructure: NERC CIP applies to bulk electric systems in North America; IEC 62443 and ISO/IEC 27001 are voluntary frameworks unless contractually required.

NERC CIP core requirements: asset categorization (CIP-002), security management controls (CIP-003), personnel and training (CIP-004), electronic security perimeters (CIP-005), and incident reporting (CIP-008).

ISO/IEC 27001 requires a risk assessment and treatment plan, Statement of Applicability, and management review; certification is a point-in-time audit, not continuous assurance.

Policy hierarchy: board-approved policy, standards that specify mandatory controls, procedures with step-level instructions, and records that evidence execution.

Risk register entries need owner, asset, threat, vulnerability, likelihood, impact, treatment (mitigate/transfer/accept/avoid), residual rating, and review date.

Exceptions are time-bound and formally approved at a level above the risk owner; an accepted risk without a compensating control and expiry date is an audit exception.

Audit evidence: access reviews, change tickets, training records, backup restore tests, and incident post-mortems; evidence must be dated and traceable to the control.

Supply chain governance: require vendor security documentation, secure development attestations (IEC 62443-4-1), and vulnerability disclosure terms in procurement contracts.

Recovery objectives: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; SCADA RPO is often zero for process state because state is re-read from the field.

BIA sequence: identify critical processes, map dependencies (SCADA, network, power, staff), set RTO/RPO, then derive recovery strategies and test plans.

Resilience design: redundant controllers, redundant networks (ring topologies), redundant historians, and geographically separate control centers with tested failover.

Manual operation capability is a continuity control: operators must be trained and drilled to run the process in manual or local mode when SCADA is unavailable.

Recovery from ransomware in OT: isolate the zone, restore from offline backups, verify firmware integrity, rotate all credentials, and validate controller logic before reconnecting.

Continuity testing cadence: tabletop annually, functional failover at least annually, full recovery exercise per policy; every exercise produces corrective actions with owners and dates.

Crisis communication: pre-agreed notification paths to regulators (NERC CIP-008 timelines), customers, and internal leadership; regulatory reporting clocks start at recognition, not resolution.

Alternate site readiness: verify that backup control centers have current network configurations, licenses, and operator credentials; an untested failover site is an assumption, not a control.