Why is securing ICS/SCADA networks more challenging than general IT networks?

• A. They are offline and not connected.
• B. They involve legacy devices, real-time requirements, proprietary protocols, and high availability needs, making patches and standard controls harder.
• C. They use standard protocols only.
• D. They have no security risks.

Answer: (B)

ICS/SCADA security is challenging because these systems operate at the intersection of heavy safety and continuous process control, not just information technology. They rely on long-lived, often legacy devices that can have limited or no patch support, and they use proprietary or non-standard protocols that aren’t easily visible to or compatible with typical IT security tools. In addition, the control processes are real-time and deterministic, so any added latency or disruption from security measures can impact plant operations or safety. The high availability requirement means downtime for maintenance or updates is often unacceptable, forcing careful change control, extensive validation, and sometimes compensating controls rather than straightforward patches. All of this together makes applying standard IT security practices more complex and less straightforward in an ICS/SCADA environment.