Is Sloppy Use of SCADA a Problem?
I’m prepping for my podcast interview with Joe Weiss on security awareness in control systems and came across one point that didn’t make the cut, but is still interesting.
Some people in the community get very upset when SCADA is used as a term to cover all control systems. They have a point that SCADA are different than DCS and other smaller, local control systems. We can take this further that a SCADA system for an oil pipeline is different than a SCADA system for electric distribution.
Different sectors use the same underlying technology for different purposes with different critical factors. It is one of the most interesting facets of my job that I get to learn a little about so many different fascinating industries. Whether it be leak detection in oil pipelines, to exchange of information between bulk electric systems, to how the comparatively slow flow of water in a canal makes scheduling difficult, …
There are parallels to SCADA where less than accurate terms achieve common usage. Most of the examples are brand names. For example, Kleenex is a brand not a tissue. Remember when you made Xeroxs on your Canon copier? And the current example is Googling replacing searching, much to the dismay of Google who is fighting this to retain trademarks. Growing up in Minnesota I remember being asked what kind of Coke I wanted, and a normal answer might be 7-Up or root beer.
So for better or worse, I claim that SCADA has achieved that common usage status. The community can fight this and try to educate everyone, including people that have no idea what a SCADA or any other type of control system is today, on the differences between the various types of control sytems, or we can accept the SCADA is used as the generic term for control systems and spend our efforts to get newcomers to understand why securing “SCADA” systems is important.
Author: Dale Peterson
Posted: June 13th, 2007 under Big Picture.
Comments: 9
Comments
Comment from Ralph Langner
Time: June 13, 2007, 11:38 am
I wouldn’t see any major differences between all the different types of control systems and architectures WHEN IT COMES TO SECURITY. Today, it makes a lot of sense to put all security issues related to control systems into one big basket. Even though I don’t like the term SCADA, I couldn’t think of anything better. In Germany, we usually refer to “industrial IT security”, but this also is a little bit awkward as many don’t regard PLCs and RTUs as IT equipment. Let’s just stick with SCADA and spend our precious time on the issues, not on the naming.
Comment from Dwight
Time: June 13, 2007, 1:50 pm
When Joe brought this issue up with me on one of my presentations, I mentally argued his point for some time. However after due time, I came around to his way of thinking. In this particular case I think Joe may be correct to point out the difference. I now try to say SCADA and control systems in my communications.
Comment from Jake Brodsky
Time: June 13, 2007, 5:27 pm
Ralph’s point is right on target. The term SCADA is morphing a lot because the features themselves are also morphing.
Yes, in the strictly classical sense, it refers to a less-than-real-time industrial process monitoring and control system. However, SCADA systems have been crossing over and handling DCS like things for years, and DCS systems have been handling something like SCADA stuff as well. Joe Weiss’s point about including other control system devices and the like is well taken. However, these things are so often getting absorbed under the umbrella of SCADA that managers and even many security experts end up confusing the two anyhow.
Joe may not like it, but this is how the English language progresses –yes, even with acronyms. (For example, laser is generally regarded as a word , not an acronym). Yeah, for an engineer to be sloppy with such terms is terrible. However many people who use it aren’t engineers any more. The term is about to get broadened.
If Joe Weiss could change the world’s sloppiness and tendency to broaden terms, I would agree with him that he’s right. However, the larger issue is about terminology and action. In a way, as real SCADA systems get more and more popular, the term itself is going to get broadened. I guess that’s the price of success.
Comment from Ron Southworth
Time: June 13, 2007, 5:50 pm
Hello Gentlemen.
We confuse things here just that little bit more in the water Industry in AU by calling it, “Telemetry” for what the US generally refers to as a SCADA system. perhaps this stems from the AS60870 “Telecontrol” word in the title? Lucky me it is in my title! and I am still an Officer to boot!
I tend towards explaining and generalising control systems as a SCADA system depending on the audience. At least it is an acronym that is becoming better known, so hey I am guilty as charged.
I think it is truely a reflection on what we are all agreeing on, that systems are converging more and more all the time. A good point Jake regarding LASER so in the end as you say the language will evolve where it does for better or worse.
I think Ralph has it right!
On the Pod Casts Dale a good first effort on the Secure DNP3 discussion and now that you have set such a high bench mark on the first one can you repeat it?
( I suspect so)
I look forward to hearing Joe in the hot seat and I am certain the interview will be illuminating!.
Many thanks
Comment from Marc Tritschler
Time: June 14, 2007, 6:02 am
My experience across Europe in this field does tell me that there can be a little bit of a problem in using SCADA as a catch-all term, especially when trying to raise awareness with people who are resistant to the idea of security on their own patch. If you talk about SCADA security, then some folks responsible for non-SCADA control systems will use this as a reason to exclude themselves and their systems from the scope of the security efforts.
The end result is that I don’t make the job any harder than it already is, and I tend to use the term “control systems”.
Comment from Ralph Langner
Time: June 14, 2007, 7:12 am
Marc, so in effect you’re just stripping off the “data acquisition” part… 
Anyway it’s fact that the term SCADA isn’t used widely in Europe, but I figure Dale’s scope was limited to NA.
Pingback from OPC Exchange Blog, Featuring Eric Murphy » Blog Archive » You Say SKAYda, I say SKAHda
Time: June 14, 2007, 12:01 pm
[...] a better question is what do you mean by it? Dale over at Digital Bond brings up the topic in a recent post, and concludes with let’s not worry about the details, and just get the ‘SCADA’ systems [...]
Comment from cnioperator
Time: June 15, 2007, 11:06 am
I think we’ve all been on the same journey!
A few years ago, I used to tear my hair out when I heard “SCADA” being used incorrectly. I’d assume (sometimes correctly) that the speaker had no knowledge of the subject if they said SCADA when they really meant DCS.
Now I find myself using “SCADA” in just the same way and have come to accept SCADA as the de facto term for all thing control.
I actually got a bit annoyed at Joe for making such a fuss over terminology at the PCSF meeting earlier this year. I remember thinking that surely we’ve got past this.
On a lighter note, my assimilation into the SCADA cult has reached a point where I’ve been heard to pronounce the word SKAYda, instead of the UK pronunciation of SKAHda.
Of course, when I’m talking to engineers within my company, I’m very careful not to use terminology incorrectly and even more careful with the pronunciation. However, when I’m out on the conference circuit with you guys, the labs and the government then SCADA is just as good a term as any other.
Comment from Mike
Time: May 19, 2010, 2:28 pm
Wow… just the fact that you have to post something to address this is kinda sad. I’m working for my school creating and maintaining a virtual SCADA system made using your images with a few tweaks here and there. Something I’ve learned about many of my colleagues is that they tend to be anti-social and can get to be really pedantic. I find it annoying. Arguing the tiniest minutiae of a difference in naming convention really doesn’t matter. What’s more important is addressing security concerns regarding these systems. I side with your judgment of SCADA becoming a common phrase to describe a plethora of systems.
Write a comment