Uncovering industrial control systems vulnerabilities by examining SCADA virtual packages and their communication protocols

Supervisory Control and Data Acquisition (SCADA) is the centralized computer system that controls and monitors the Industrial Control Systems (ICS) that are connected to it. SCADA is used in various industries and the military, and it is essential to many critical infrastructures. However, in most nations SCADA was introduced a few decades ago, as one of their security measures. With rapid technology advancement over the decades, this out-dated security measure could never be on par with the security risks that SCADA systems are facing. It is necessary to investigate the potential vulnerabilities on the structural level and mitigate them. Focusing on the software vulnerabilities, this paper aims to investigate the potential security issues that could cause malfunction of SCADA systems that control critical infrastructures, including electricity, water, gas, traffic, military, and others which causes impact to the survival of a nation. With various SCADA packages available in the market, Citect SCADA from Schneider Electric Corporation has been selected for this research due to their popularity in Australian industry. Several versions of the Citect SCADA are being used in the investigation due to the fact previous versions are still widely used in industry at the time of writing. This paper investigates the structure and functionality of the SCADA packages to uncover their vulnerabilities and proposes recommended countermeasures.