I85PREP
⌘ K
Lead SCADA Security Manager study materials
Lead SCADA Security Manager study resources

Lead SCADA Security Manager: SCADA Security

Lead SCADA Security Manager · Work through your exam, one topic at a time.

All guide sections

SCADA Security

This domain tests how you secure SCADA and OT systems on their own terms, not by copying IT patterns. Expect questions on architecture, segmentation, protocol weaknesses, and how IEC 62443 concepts are applied in practice.

Core rules

  • In OT the priority order is safety, availability, integrity, confidentiality; IT usually starts with confidentiality.
  • Map assets to the Purdue model (Levels 0–4/5). Group them into zones and conduits using IEC 62443-3-2, then set a target security level (SL-T) from risk assessment and verify the achieved level (SL-C) against the seven foundational requirements (FR1–FR7) in IEC 62443-3-3.
  • Legacy protocols such as Modbus/TCP, DNP3, and OPC Classic lack strong authentication and encryption. Compensate with strict conduits, deep-packet inspection, allowlists, and unidirectional gateways where flows permit.
  • Remote access should terminate in an OT DMZ jump host with MFA, session recording, and time-bound vendor accounts-never direct VPN into Level 1.
  • Build a passive asset inventory first; active IT scanning can disrupt PLCs and RTUs.

Worked example

A water utility adds a cellular-connected remote pump station. Place the RTU in a Level 1 zone, terminate the cellular VPN at a Level 3.5 DMZ jump host, require MFA, and permit only maintenance-window access. Reasoning: the cellular path is untrusted, the DMZ removes direct enterprise-to-Level 1 paths, and the zone's risk assessment sets SL-T 2, which you verify by checking each applicable FR rather than assuming the VPN delivers it.

Traps that cost marks

  • Claiming an "air gap" without verifying it; maintenance laptops and cellular modems often bridge it.
  • Confusing SL-T (target) with SL-A (achieved) or treating IEC 62443 as a product checklist.
  • Using IT scanning and patch tools against live control networks.

Key points

  • OT priority: safety, availability, integrity, confidentiality.
  • Zones and conduits are the primary architectural control.
  • Compensate for weak protocols; do not assume encryption exists.
  • Remote access belongs behind an OT DMZ with MFA and logging.
  • Passive discovery before active scanning.
  • Distinguish SL-T from SL-C and verify both.