A Taxonomy of Cyber Attacks on SCADA Systems

TLDR

SCADA systems are integral to critical infrastructure, operating in real‑time over geographically dispersed networks, yet they lack robust protection and are increasingly vulnerable to cyber damage due to standardization and connectivity. This study aims to safeguard SCADA by contrasting them with conventional IT systems, establishing security property goals, and systematically identifying and classifying likely cyber‑physical attacks. The authors develop an attack taxonomy based on impact on control performance, highlighting commonalities and key features that pose unique security challenges to SCADA compared to traditional IT.

Abstract

Supervisory Control and Data Acquisition(SCADA) systems are deeply ingrained in the fabric of critical infrastructure sectors. These computerized real-time process control systems, over geographically dispersed continuous distribution operations, are increasingly subject to serious damage and disruption by cyber means due to their standardization and connectivity to other networks. However, SCADA systems generally have little protection from the escalating cyber threats. In order to understand the potential danger and to protect SCADA systems, in this paper, we highlight their difference from standard IT systems and present a set of security property goals. Furthermore, we focus on systematically identifying and classifying likely cyber attacks including cyber-induced cyber-physical attack son SCADA systems. Determined by the impact on control performance of SCADA systems, the attack categorization criteria highlights commonalities and important features of such attacks that define unique challenges posed to securing SCADA systems versus traditional Information Technology(IT) systems.