Importance of penetration testing SCADA system

SCADA was considered a closed system. But nowadays when interconnections and integration between different systems is crucial for digitalization of the company business process even SCADA systems are becoming more and more accessible from other networks and ICT elements.

When we are talking about SCADA system most of the time devices and servers in this network do interact with physical world, control of electrical grid, traffic control and monitoring, managing water and pool systems and other complex industrial systems. With this in mind we can see the importance that this kind of network and systems are designed and secured as much as possible, as any unwanted breach in SCADA network could even harm people, significant damage on infrastructure.

Even closed SCADA systems were hacked in the future, so it is even more important to perform security audits and penetration testing of SCADA systems in these days as any interconnection with other networks does represents possible attack vector.

It is crucial to perform penetration test from different stand points, from internal networks to simulate possible insider threat and identify critical vulnerabilities in the SCADA network, assess the risk factor and make remediation plan to have a proper picture of security status in SCADA network.

Great importance is to test the SCADA network from “outside” or in other words perform “black-box” penetration test as this is important security test of ICT/SCADA infrastructure. One of the most important elements of penetration testing is “social engineering” as people often poses the greatest threat to ICT system, as potential attacker can convince them in many ways to help them get access to corporate or SCADA network, via email, social media, forums, phone calls and even in person.

During the digitalization era it is important to take proper approach to interconnect SCADA with different ICT systems. As important as taking a proper approach to interconnect SCAD is to properly secure those interconnections and perform security audits and penetration tests to properly validate implemented security measures.