SCADA Cybersecurity for Automation Engineers: IEC 62443 Basics Every Plant Now Expects You to Know
Why this is now your job
A SCADA network used to be an island. It is not any more: remote access for the OEM, OPC UA to the MES, MQTT to the cloud, a USB stick from a vendor's laptop. Ransomware groups have noticed. In India, the CERT-In guidelines and customer audits in pharma, power and oil and gas now put OT security questions to the automation team, not only to IT.
IEC 62443 (originally ISA-99) is the family of standards for security of industrial automation and control systems. You do not need to read all fourteen parts. You need the vocabulary and the handful of practices that come from them.
The Purdue model, still the map
Every OT security conversation starts with levels:
- Level 0: sensors and actuators.
- Level 1: PLCs, RTUs, safety controllers.
- Level 2: HMI, SCADA servers, engineering stations.
- Level 3: site operations: historians, MES, domain controllers for OT.
- Level 3.5: the industrial DMZ.
- Level 4 and 5: enterprise IT and the internet.
The rule that follows from it: nothing at Level 4 talks directly to Level 2 or below. Data crosses through the DMZ, through a historian mirror or an MQTT broker, never by a direct connection to the PLC.
Zones, conduits and security levels
IEC 62443-3-2 asks you to divide the plant into zones (groups of assets with the same security needs) joined by conduits (the communication paths between zones). Each zone gets a target Security Level:
| Level | Protects against |
|---|---|
| SL 1 | Casual or accidental misuse |
| SL 2 | Intentional attack with simple means and low resources |
| SL 3 | Sophisticated attack with moderate resources and IACS-specific skills |
| SL 4 | State-level attack with extended resources |
Most plant zones target SL 2; safety systems and critical utilities target SL 3. The level drives which of the seven foundational requirements (identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability) apply, and how strictly.
The ten controls that do most of the work
If a plant did only these, it would be ahead of most:
- Segment the network. Managed switches, VLANs, a firewall between OT and IT, a DMZ for anything shared.
- No direct internet from the control network. Ever.
- Remote access through a jump host with MFA, recorded, time-limited, and switched off when not in use. Not TeamViewer on the SCADA PC.
- Inventory. You cannot protect a PLC you do not know exists. Keep a list with firmware versions.
- Back up PLC programs and SCADA projects, off the network, and test a restore.
- Change the default passwords, and give people their own accounts.
- Patch what can be patched, on a schedule agreed with production; isolate what cannot.
- USB control. Scanning kiosks or a ban with an exception process.
- Log and watch. Syslog from switches and firewalls to something a person reviews.
- An incident plan that says who pulls the plug and how the plant runs by hand.
What it means when you commission
- Enable Sign and Encrypt on OPC UA. Do not leave the None policy open.
- Use the PLC's access protection: TIA Portal's protection levels and know-how protection; Rockwell's FactoryTalk Security.
- Put the engineering laptop on the OT network only when needed, patched and scanned.
- Document the conduits you create. Every new connection to the PLC is a new conduit and somebody has to approve it.
Learning it
The free OT and ICS Cybersecurity course walks through zones, conduits, risk assessment and the standard's structure with practical exercises; the PROFINET and Industrial Communication courses cover the network layer it sits on. For certification, the ISA/IEC 62443 Cybersecurity Fundamentals Specialist is the recognised entry credential.
Frequently asked questions
Is antivirus enough on the SCADA server? No. Segmentation and access control matter more, because most OT attacks arrive through remote access or removable media, not through a virus signature.
Can we air-gap instead? True air gaps rarely survive the first vendor visit. Assume connections exist and control them.
Who owns OT security, IT or automation? Both, formally. In practice the automation team owns the zone design and the PLC-side controls, and IT owns the firewalls and identity.
