Lead SCADA Security Manager key terms

A control architecture that uses remote telemetry and supervisory software to monitor and command field devices across widely distributed industrial sites, typically through RTUs, PLCs, and communication links.

A rugged field device that collects measurements from sensors, performs basic local logic, and reports to a master station over long-distance or low-bandwidth links, often buffering data during outages.

A programmable controller that executes deterministic logic to drive actuators and machinery, often at higher speed than an RTU and increasingly network-connected, making firmware and program integrity a security concern.

A reference layering of industrial networks from physical process (Level 0) up through control, operations, plant systems, and enterprise IT, used to place zones, conduits, and security controls.

A buffer network between industrial control systems and enterprise IT that terminates and inspects all crossing traffic, preventing direct connections while allowing brokered data exchange.

A hardware device that enforces one-way data flow, allowing telemetry to leave an industrial network while physically preventing commands or malware from entering it.

Dividing a network into isolated zones with controlled interconnections so that compromise or broadcast traffic in one area cannot spread unchecked to critical control assets.

In zone-and-conduit design, a defined communication path between security zones whose traffic is restricted, monitored, and documented to reduce attack surface.

A grouping of assets that share security requirements and trust level, established so that controls and monitoring can be applied consistently to everything inside its boundary.

A widely used industrial protocol that historically lacks authentication and encryption, so its use requires compensating controls such as segmentation, monitoring, and strict access restriction.

A telemetry protocol common in electric and water utilities that supports time-stamped events and secure authentication extensions, though many deployments still run without them.

The operator interface that displays process state and accepts commands, making it a high-value target whose compromise can mislead operators or issue unauthorized control actions.

A privileged host used to configure controllers and change logic; its access, patching, and media use are tightly controlled because changes there directly alter physical process behavior.

An independent protection layer that drives the process to a safe state on hazardous conditions, requiring separate security treatment so cyber events cannot defeat its protective function.

The property that systems and process control remain usable when needed; in industrial settings it often outranks confidentiality, shaping which security controls are acceptable.

The international series of standards for industrial automation security, covering requirements for operators, system integrators, and product suppliers, including security levels and zones.

In IEC 62443, a graded target describing resistance to defined attacker capability, used to specify and verify how well a zone or component must withstand compromise attempts.

A voluntary framework organized around identify, protect, detect, respond, and recover functions, used to structure program maturity and communicate posture to executives and regulators.

A staged scale describing how consistently and measurably practices are performed, used to set improvement targets and justify investment rather than to certify compliance.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements that guide decisions on controls and residual risk.

The acceptable variation around risk appetite for a specific asset or activity, translating high-level willingness into concrete thresholds used when approving exceptions.

The risk remaining after controls are applied, which must be documented and formally accepted by an accountable owner rather than assumed to be eliminated.

Selecting and applying options such as mitigate, transfer, avoid, or accept, with justification and ownership recorded for each identified risk.

A maintained record of identified risks with owners, ratings, treatments, and review dates, serving as the audit trail that risk decisions were made deliberately.

A study that identifies critical processes and quantifies the operational, financial, safety, and regulatory consequences of their disruption over time.

The maximum acceptable elapsed time to restore a process or system after disruption, driving architecture and backup decisions for critical control functions.

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for historians and configuration repositories.

A documented set of roles, escalation paths, and procedures for detecting, containing, eradicating, and recovering from security incidents, tested through exercises.

A discussion-based simulation in which stakeholders walk through a realistic scenario to test decision-making, communications, and gaps without touching production systems.

Documented arrangements for keeping or resuming critical operations during disruption, including manual workarounds for lost automation and alternate communications.

A designed fallback in which operators run the process without central automation, requiring trained staff, local controls, and documented procedures validated in advance.

A controlled process for approving, testing, scheduling, and recording modifications to systems and configurations so that changes do not introduce unexamined risk.

A documented, approved reference state of hardware, software, and settings against which drift is detected and restoration is verified after incidents.

Granting only the access needed to perform a role, minimizing the blast radius of stolen credentials, particularly for accounts that can alter control logic.

Controls such as vaulting, session recording, and just-in-time elevation that protect accounts capable of reconfiguring industrial systems or bypassing safeguards.

Requiring two or more independent credential types for access, applied especially to remote and vendor connections where password compromise would otherwise grant direct control access.

Any externally initiated connection into operational networks, requiring brokered entry, strong authentication, logging, and time-limited authorization for vendors and staff.

A current record of hardware, software, firmware, and network assets with owners and criticality, forming the foundation for vulnerability management and incident scoping.

A repeatable cycle of identifying, prioritizing, and remediating weaknesses using risk context, compensating controls, and vendor guidance where patching is infeasible.

An alternative safeguard used when a preferred control cannot be applied, such as isolating an unpatchable controller behind strict segmentation and monitoring.