Supervisory
SCADA Server
The supervisory application that polls field devices, maintains the real-time database and drives operator displays and alarms.
Critical criticalityLevel 2 – Level 3
What it does
Aggregates telemetry across many sites, applies alarming, issues supervisory control commands.
Typically locatedControl centre server room or plant operations zone, often redundant pairs.
At a glance
PurdueLevel 2 – Level 3
CategorySupervisory
Protocolsdnp3, iec-60870-5-104, modbus-tcp, opc-ua, iec-61850
Talks toRTUs, PLCs, HMI clients, Historian, Alarm systems
Common vendorsAVEVA, Schneider Electric (EcoStruxure Geo SCADA Expert), GE Vernova, Siemens (WinCC OA, SICAM PAS), ABB (MicroSCADA X SYS600), Inductive Automation
Why should I care?
SCADA Server sits at Level 2 – Level 3. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Broad reachability to every field site by design
- Service accounts with wide privilege
- Legacy OS and database components
If it is compromised
- Wide-area operational impact
- Falsified operator view
- Mass command capability
What to monitor
- Command issuance vs operator action
- Account and service logons
- Configuration/tag database changes
- Polling anomalies
How to defend it
- Harden and patch on a defined maintenance cadence
- Restrict administrative access with MFA and PAM
- Redundancy plus tested restoration
Hunting
Hunt ideas for this component
Related