The short answer
Third-Party Software
A SCADA server runs far more than the SCADA: communication drivers, OPC servers, a database engine, language runtimes, reporting and PDF tools, backup and antivirus agents, hypervisor tools, and often a remote support utility or a browser that nobody remembers installing. Each one is code that can be exploited, each has its own updates and its own habit of calling home, and each widens what an attacker can do. The control is an inventory of every installed product on every machine, an approved list of what is allowed for each role, a rule that nothing is installed outside change management, updates for third-party software inside the patch cycle, downloads verified against vendor signatures and hashes from vendor sources only, automatic updaters and telemetry disabled on the control network, and a periodic removal of anything not on the list.
Key points
- The SCADA is a fraction of the code on the server; the rest needs the same attention.
- Inventory everything installed on every machine, then decide what is approved for each role.
- Nothing is installed outside change management, including by vendors during support sessions.
- Third-party updates are part of the patch cycle; automatic updaters and telemetry are disabled.
- Downloads come from the vendor, verified by signature or hash, through the DMZ, never on a USB drive from a laptop.
- Remove what is not used; a program that is not there cannot be exploited.
What is on the server
| Category | Examples | Concern | Control |
|---|---|---|---|
| Communication software | Protocol drivers, OPC servers, gateway software | Listens on the network; often old; parses untrusted data from devices | Vendor-supported versions; patched in the cycle; only the drivers in use installed |
| Databases and runtimes | Database engines, language runtimes, frameworks | Large attack surface; frequent vulnerabilities; installed as dependencies and forgotten | Versions tracked; patched with vendor qualification; unneeded features disabled |
| Reporting and office tools | Report engines, spreadsheet tools, PDF readers, browsers | Document-based attacks; browsers reach out | Installed only where a report is generated; browser removed from servers where possible |
| Agents | Antivirus, backup, monitoring, hypervisor tools, management agents | Run with high privilege; talk to management servers | From the approved list; management servers in the DMZ; versions in the patch cycle |
| Remote support tools | Screen sharing and remote control utilities | Outbound connections to the internet; a permanent door | Not permitted; remote access goes through the jump host |
| Utilities | File transfer, compression, diagnostic, and configuration tools | Installed during troubleshooting and never removed | Removed after use or added to the approved list with a reason |
| Vendor engineering tools | Controller programming software, device configuration tools | Powerful; licensed; sometimes require internet activation | On engineering workstations only; activation through a controlled path |
Bringing it under control
- 1
Inventory
Every installed program on every control system machine, with version and purpose, from the operating system inventory and a walk of each machine. Expect surprises.
- 2
Decide
For each machine role, the approved list: what is required, what is allowed, and what is removed. Every item on the list has a reason and an owner.
- 3
Remove
Uninstall everything not on the list, one machine at a time, with a backup first and the application tested after.
- 4
Enforce
Application allowlisting so that unlisted software cannot run even if installed, and administrative rights limited so that it cannot be installed casually.
- 5
Maintain
Third-party updates in the patch cycle with their own vendor checks; the inventory updated at every change; a quarterly comparison of what is installed against the list.
Rules
- No installation outside change management. That includes the vendor engineer who wants to install a diagnostic tool during a support session; the tool is approved or it is not installed.
- Downloads from the vendor site or the vendor portal, verified by the published hash or the code signature, transferred through the DMZ file transfer path, and scanned. Not from a search result, not from a laptop, not from a USB drive that was in a truck.
- Automatic updaters, telemetry, and license phone-home disabled or blocked at the firewall; updates come through the cycle. A control zone machine has nothing to say to the internet.
- No remote support utilities. The jump host with multi-factor authentication is the way in, for the vendor as much as for staff.
- Vendor engineering software on dedicated engineering workstations, not on servers or consoles.
- Licenses and installers kept with the backups, so a rebuild does not require a download under pressure.
The supply chain
Software arrives from somewhere, and the somewhere matters. A driver package from a reseller website, an installer from a file sharing site because the vendor portal was slow, a firmware image emailed by a contractor: each is a chance to install something that is not what it claims. Vendor sources, signature and hash verification, and a controlled transfer path are how software enters the control zone. Where the vendor provides a software bill of materials, keep it with the inventory; when a vulnerability in a runtime or a library is announced, it says which products on the system contain it.
Frequently asked questions
- The SCADA vendor installer put a database and a runtime on the server. Are those third-party?
- Yes, and they are the most important ones. The vendor bundles them and qualifies updates for them; the utility patches them through the vendor guidance, tracks their versions, and disables the features the SCADA does not use. A vulnerability in the bundled database is a vulnerability in the SCADA server.
- Do we need a browser on the engineering workstation?
- Only if a vendor tool or a device configuration page requires one, and then a hardened browser that reaches only the control network, with no internet access. Servers and consoles do not need one at all.
- How do vendor tools that require internet activation get activated?
- Through an offline activation process, which most vendors provide, or on a machine in the DMZ set up for the purpose, or by a temporary, logged, specific firewall rule opened through change management and closed afterward. Not by giving the engineering workstation general internet access.
- What is the minimum for a small utility?
- A list of what is installed on each machine, a decision about what stays, removal of the rest, no remote support utilities, and third-party updates included whenever the operating system is patched. That takes a day and removes most of the exposure.
Related topics
- Server HardeningReducing what an attacker can do with a SCADA server: a baseline from the vendor guide and a benchmark, unused services removed, the host firewall on, application allowlisting, controlled media, separate administrator accounts, and logs sent off the box.
- Patch ManagementApplying updates to SCADA servers and clients without breaking the plant: vendor qualification, a monthly cycle with a test system, priority from the exposed edge inward, backups and rollback, emergency patches, and handling software that cannot be patched.
- Jump HostsThe one machine every remote session must pass through: what a jump host is, how it is hardened, what it may reach, session recording, the tools it carries, and why a vendor laptop never gets past it.
- Building an OT Asset InventoryThe list of everything in the control system with a network interface or a program, and how to build one that is right: what counts, the fields to record, the site walk, the switch tables and passive listening that find the rest, and keeping it current.
- Change Management for OTA change process sized for a utility control system: what counts as a change, the request with risk and rollback, owner approval, the window, backup before and verification after, the baseline update, the emergency path, and the record.
- Advisories and AlertsWhere a utility learns its equipment has a known vulnerability and what to do with the news: the government and vendor advisory feeds, the sector center, the exploited catalog, subscribing by product, a weekly triage on exposure and consequence, and records.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.