Programmable logic controllers and SCADA systems run the physical world: they open valves, drive motors, and keep processes within safe limits. They were designed for reliability and real-time control on a trusted network, in an era when network security was not the concern it is now.
That heritage is why securing them is difficult and why the most effective control is often the simplest in concept: limit who can reach them, and when. This article looks at why control systems are fragile and how reducing reachability protects them.
01Key takeaways
- 01
PLCs and SCADA systems were built for reliability and real-time control, not for resisting network attack.
- 02
Many industrial protocols are insecure by design, lacking authentication or encryption.
- 03
Patching control systems is hard because uptime, safety and vendor support constrain change.
- 04
Because hardening the devices is limited, reducing their reachability is often the strongest available control.
- 05
Engineering access can be confined to deliberate windows, and monitoring can avoid inbound paths.
02What PLCs and SCADA are, and why they are fragile
A PLC is a ruggedized controller that executes the logic driving a physical process. SCADA systems supervise and coordinate those controllers across an area or site, giving operators visibility and control. Together they are the nervous system of industrial operations.
Their fragility is not carelessness; it is heritage. They were designed to do one job reliably for decades on a network assumed to be trusted and isolated. Confidentiality and authentication were not design goals, because the threat model did not include a hostile network.
Control systems are not insecure by accident; they were built for a world where the network itself was the perimeter.
03Insecure-by-design protocols
Many of the protocols that control systems speak were created without security features. They often have no authentication, so any device that can reach a controller can issue commands, and no encryption, so traffic can be read and manipulated.
- Commands may be accepted from any reachable source without verifying identity.
- Traffic can be observed and altered because it is unencrypted.
- Protocol functions intended for engineering can be invoked by anyone with network access.
- Adding security to these protocols after the fact is often impractical on existing equipment.
The implication is stark: for many control systems, network reachability is effectively access. If a system can reach the controller, it can often command it.
04Why patching is hard
The instinct from IT is to patch, but control systems resist it. Production cannot easily stop, changes risk safety and stability, and vendor certification may tie a system to a specific configuration.
- Downtime for patching can be costly or operationally unacceptable.
- Changes to a controlled process carry safety and stability risk.
- Vendor support and certification may constrain what can be changed.
- Some equipment is simply too old to receive updates at all.
Patching still matters where feasible, but it cannot be the primary defense for systems that may go years between safe maintenance windows.
05Segmentation and least reachability
If the devices cannot be hardened much and cannot be patched freely, the lever that remains is reachability. The fewer systems that can reach a controller, and the less time they can, the smaller the opportunity to attack it.
Segmentation into zones is the foundation, placing controllers in tightly controlled zones with deliberately limited conduits. For the most sensitive control segments, an AIRGAPNET controlled connectivity pattern can keep them disconnected by default and reachable only for approved engineering or data windows, so reachability is the exception rather than the default.
06Engineering-access windows
Engineers need to reach controllers to make changes, but they need to do so occasionally, not continuously. That makes engineering access an ideal candidate for time-bound connectivity.
Rather than leaving an engineering path permanently open, it can be opened for an approved task and closed afterward. The controller is reachable when work is happening and unreachable the rest of the time, which is most of the time.
07Monitoring without inbound paths
Visibility into control systems is valuable, but it should not come at the cost of a new inbound path. Monitoring data can be pushed outward rather than collected by a tool reaching in.
Forwarding telemetry and events one way to a monitoring platform keeps the visibility while preserving the principle that nothing initiates traffic toward the controller. Observation does not have to mean reachability.
08Closing thought
PLCs and SCADA systems will not become hardened, encrypted, easily patched devices any time soon. They are built to run a process reliably, and that is what they will keep doing. Securing them means accepting the devices as they are and controlling the network around them.
Reduce who can reach them and when, confine engineering access to deliberate windows, and monitor without opening inbound paths. For systems where reachability is access, controlling reachability is the security.
FAQFrequently asked questions
Why are PLCs and SCADA systems insecure?
They were designed for reliability and real-time control on a network assumed to be trusted and isolated. Authentication and encryption were not design goals, so many industrial protocols accept commands from any reachable device without verifying identity.
Why is patching PLCs and SCADA difficult?
Production uptime, safety and stability risk, and vendor certification all constrain change, and some equipment is too old to update. Patching matters where feasible but cannot be the primary defense for systems that go years between safe maintenance windows.
If you cannot patch control systems, how do you secure them?
By reducing reachability. Segment controllers into tightly controlled zones, limit which systems can reach them and for how long, confine engineering access to deliberate windows, and keep the most sensitive segments disconnected by default.
What does 'reachability is access' mean for control systems?
Because many industrial protocols lack authentication, any system that can reach a controller can often command it. That makes network reachability effectively equivalent to access, so controlling reachability becomes the central security control.
How can control systems be monitored safely?
By pushing telemetry and events outward to a monitoring platform rather than having a tool reach in. One-way forwarding preserves visibility while ensuring nothing initiates traffic toward the controller.
SRCSources of record
Control the network, not just the device
Where reachability is access, control the reachability.
Keep sensitive control segments disconnected by default, confine engineering access to approved windows, and monitor one-way, so controllers are reachable only when they must be.