ICS/SCADA

ICS/SCADA
Name	Industrial Control Systems / Supervisory Control and Data Acquisition
Caption	Control room with HMI panels
Type	Control systems
Introduced	Mid-20th century
Developer	Various vendors and research institutions

ICS/SCADA Industrial control systems and supervisory control and data acquisition systems coordinate automated processes across infrastructure and industry, integrating sensors, controllers, and human–machine interfaces to manage physical assets. These systems evolved through contributions from companies and institutions involved in process automation, plant engineering, and computing, and are deployed across utilities, manufacturing, transportation, and defense sectors.

Overview

Industrial control systems have roots in early electromechanical control pioneered by firms and laboratories such as Siemens, General Electric, Westinghouse Electric Corporation, Bell Labs, IBM, and Honeywell International Inc. and were influenced by standards bodies including International Electrotechnical Commission, IEEE, and National Institute of Standards and Technology. Supervisory control and data acquisition architectures emerged alongside programmable logic controllers developed by Modicon and research at Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University. Deployment spans operators such as ExxonMobil, BP plc, Siemens Energy, General Motors, Boeing, Siemens Healthineers, Apple Inc., Microsoft, Google LLC, Amazon (company), and public utilities including Tennessee Valley Authority, National Grid (Great Britain), Électricité de France, and Tokyo Electric Power Company. Historic incidents that shaped attention include events involving Stuxnet, Ukraine power grid cyberattack, Maroochy Water Services sewage spill, and industrial accidents investigated by United States Nuclear Regulatory Commission and Occupational Safety and Health Administration.

Architecture and Components

Typical architectures separate field devices, control devices, supervisory systems, and enterprise integration; vendors and projects from Schneider Electric, Rockwell Automation, ABB Group, Emerson Electric Co., Yokogawa Electric Corporation, Mitsubishi Electric, and Omron Corporation provide components such as programmable logic controllers, remote terminal units, distributed control systems, and human–machine interfaces. Field devices include sensors and actuators manufactured by Honeywell, Endress+Hauser, Emerson Process Management, and Festo; controllers reference designs from Siemens PLM Software and academic initiatives at University of Cambridge, ETH Zurich, and Imperial College London. Supervisory systems integrate historians and data platforms developed by OSIsoft (now AVEVA), Schlumberger, SAP SE, Oracle Corporation, and IBM Watson. Integration with enterprise resource planning systems from SAP SE, Oracle Corporation, and Microsoft Dynamics links to supply chains operated by firms such as DHL, Maersk, and FedEx Corporation.

Communication Protocols and Standards

Communication stacks rely on protocols and standards promulgated by organizations including International Electrotechnical Commission, IEC 60870, IEC 61850, IEC 61131, IEEE 802, OPC Foundation, and Internet Engineering Task Force. Common field and supervisory protocols include Modbus, DNP3, PROFIBUS, PROFINET, BACnet, EtherNet/IP, IEC 60870-5-104, and OPC UA with implementations from Schneider Electric, Rockwell Automation, Siemens, Hewlett-Packard, Cisco Systems, Juniper Networks, and Siemens Mobility. Networking infrastructure leverages routers and switches by Cisco Systems, Arista Networks, Huawei, and HPE Aruba and time-synchronization technologies like Network Time Protocol and Precision Time Protocol used in projects by National Instruments and Keysight Technologies. Standards-setting and compliance testing frequently involve Underwriters Laboratories, Det Norske Veritas, Lloyd's Register, and TÜV Rheinland.

Security and Threats

Security posture is influenced by cyber incidents and guidance from National Institute of Standards and Technology, Department of Homeland Security, European Union Agency for Cybersecurity, National Cyber Security Centre (UK), Cybersecurity and Infrastructure Security Agency, and industry consortia such as Industrial Internet Consortium and ISA (International Society of Automation). Threats include advanced persistent threats exemplified by Stuxnet and nation-state activity attributed in analyses involving NSA, GCHQ, FSB (Russia), and PLA (People's Liberation Army), as well as ransomware campaigns targeting operators like Colonial Pipeline and incidents involving JBS S.A.. Security controls reference frameworks from NIST SP 800-82, ISO/IEC 27001, NERC CIP, and guidance from ENISA; vendors and integrators such as FireEye (Mandiant), CrowdStrike, Palo Alto Networks, Fortinet, McAfee, Symantec (Broadcom) and consultancies including Deloitte, PwC, KPMG, and EY provide assessments and mitigation services. Physical safety regulators such as Occupational Safety and Health Administration and European Agency for Safety and Health at Work inform incident response that may involve FBI coordination in the United States.

Applications and Industry Use Cases

Deployments span electric power systems managed by Siemens Energy, General Electric, Hitachi Energy, and grid operators like National Grid (Great Britain); water and wastewater utilities such as Veolia Environnement and SUEZ (company); oil and gas facilities owned by ExxonMobil, Shell plc, Chevron Corporation, and Saudi Aramco; manufacturing plants operated by Toyota Motor Corporation, Ford Motor Company, General Motors, Boeing, and Lockheed Martin; building automation projects by Johnson Controls, Carrier Global, and Johnson Controls International; and transportation systems run by Amtrak, London Underground, Deutsche Bahn, and Union Pacific Railroad. Specialized use cases include chemical process control in facilities by BASF, Dow Chemical Company, and Bayer AG; mining automation by Rio Tinto, BHP, and Vale S.A.; and renewable energy integration in projects by Ørsted (company), Vestas, and Siemens Gamesa Renewable Energy.

Regulations and Best Practices

Regulatory frameworks and best practices draw on mandates and guidance from North American Electric Reliability Corporation, Federal Energy Regulatory Commission, Environmental Protection Agency, European Commission, UK Health and Safety Executive, NERC CIP, ISO/IEC 27001, and NIST Cybersecurity Framework. Industry standards and technical committees include ISA-99/IEC 62443, IEC TC 57, IEEE Power & Energy Society, and OPC Foundation working groups. Best practices emphasize network segmentation championed in studies by SANS Institute, CERT Coordination Center (CERT/CC), and MITRE Corporation (including ATT&CK), secure remote access hardened per CISA advisories, patch management methodologies used by Microsoft, Red Hat, and Canonical (company), and supply chain risk management recommended by Office of the Director of National Intelligence and World Bank frameworks. Training and certification programs are offered by International Society of Automation, ISC2, (ISC)², SANS Institute, CompTIA, and university programs at Georgia Institute of Technology, Purdue University, and University of Texas at Austin.

Category:Industrial automationCategory:Critical infrastructure