Control
Remote Terminal Unit (RTU)
A field controller at a geographically remote site that collects telemetry and executes control commands from a master station.
Critical criticalityLevel 1
What it does
Acquires I/O, timestamps events and communicates over telecontrol protocols across wide-area links.
Typically locatedSubstations, pump/lift stations, wellheads, pipeline valve sites.
At a glance
PurdueLevel 1
CategoryControl
Protocolsdnp3, iec-60870-5-104, iec-60870-5-101, modbus-rtu, modbus-tcp
Talks toSCADA server, IEDs, Local HMI, Cellular / radio modems
Common vendorsSEL, Schneider Electric (SCADAPack, Easergy T300), Siemens (SICAM A8000), GE Vernova, ABB (RTU500), Unitronics
Why should I care?
Remote Terminal Unit sits at Level 1. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Wide-area links historically unencrypted
- Physically remote with limited monitoring
- Cellular modems providing inbound reachability
If it is compromised
- Remote operation of field equipment
- Falsified telemetry to the control centre
What to monitor
- Command activity vs operator action
- Link state and unexplained resets
- Configuration changes
- Local login events
How to defend it
- Encrypt or authenticate wide-area links (e.g. DNP3-SA, network-layer VPN)
- Physical intrusion detection at remote sites
- Restrict master addresses
Hunting
Hunt ideas for this component
Related