Legacy systems are older technologies, hardware, or software that remain in use despite newer alternatives being available. These systems continue operating because they perform critical functions, replacement costs are prohibitive, or dependent processes cannot easily migrate to modern platforms.
In IT environments, legacy systems might include aging servers running outdated operating systems, mainframe computers from previous decades, custom applications written in obsolete programming languages, or hardware that manufacturers no longer support. Despite their age, these systems often perform essential business functions that organizations cannot afford to interrupt.
The challenge with legacy systems lies in balancing their continued operation against increasing security vulnerabilities, compatibility issues, and the declining availability of expertise and replacement parts.
What Are Embedded Systems?
Embedded systems are specialized computers built into larger devices or equipment to perform dedicated functions. Unlike general-purpose computers that run various applications, embedded systems execute specific tasks as part of the equipment they control.
Embedded systems surround us in daily life. Automobile engine control units manage fuel injection and emissions. Medical devices monitor patient vital signs and deliver treatments. Industrial machinery controls manufacturing processes. Consumer electronics from smart thermostats to microwave ovens contain embedded processors running specialized software.
These systems typically have limited resources compared to general-purpose computers—less memory, slower processors, and minimal user interfaces. They're designed for reliability and efficiency in their specific application rather than flexibility.
Characteristics of Embedded Systems
Embedded systems share several common characteristics. They perform dedicated functions rather than general-purpose computing. Real-time operation is often required, meaning the system must respond within strict time constraints. Resources are constrained with limited memory, processing power, and storage. User interfaces are minimal or nonexistent since many embedded systems operate without direct human interaction. Long operational lifespans are common, with many embedded systems designed to operate for years or decades.
Because embedded systems are designed for specific purposes and long lifespans, they often run older software that cannot be easily updated. This creates security challenges as vulnerabilities are discovered in operating systems and software that embedded systems cannot readily patch.
Supervisory Control and Data Acquisition (SCADA)
What Is SCADA?
SCADA (Supervisory Control and Data Acquisition) refers to industrial control systems used to monitor and control infrastructure and industrial processes. SCADA systems manage critical operations including electrical power grids, water treatment facilities, oil and gas pipelines, manufacturing plants, and transportation systems.
These systems collect real-time data from sensors and equipment across potentially vast geographic areas, display that information to operators, and allow remote control of industrial processes. A single SCADA system might monitor thousands of sensors spread across hundreds of miles of pipeline or an entire metropolitan power grid.
SCADA represents a critical intersection of legacy systems, embedded systems, and cybersecurity concerns. Many SCADA installations have operated for decades using proprietary protocols and hardware designed before cybersecurity was a significant concern.
SCADA Components
SCADA systems consist of several interconnected components working together to monitor and control industrial processes.
Human-Machine Interface (HMI) provides the operator interface to the SCADA system. HMI displays present real-time data through graphical representations of the controlled process, showing equipment status, measurements, and alarms. Operators use the HMI to monitor operations and issue control commands. HMI systems range from simple text displays to sophisticated graphical interfaces showing animated process diagrams.
Master Terminal Unit (MTU) or SCADA server acts as the central computer that communicates with field devices, processes data, and presents information to operators. The MTU collects data from remote sites, stores historical information, executes control logic, and manages communications with all connected devices.
Remote Terminal Units (RTUs) are ruggedized computers deployed at remote sites to collect data from local sensors and execute control commands. RTUs interface with physical equipment—reading temperatures, pressures, flow rates, and equipment status, then transmitting this data to the central MTU. They also receive commands from the MTU and control local equipment accordingly.
Programmable Logic Controllers (PLCs) are industrial computers that automate specific processes or machinery. PLCs execute programmed logic to control equipment based on sensor inputs. While RTUs typically handle remote monitoring and communication, PLCs focus on direct equipment control. Many modern SCADA systems use PLCs alongside or instead of traditional RTUs.
Communication Infrastructure connects all SCADA components. This may include dedicated leased lines, radio communications, cellular networks, satellite links, or increasingly, internet protocol networks. Communication reliability is critical since loss of connectivity means operators cannot monitor or control remote equipment.
Field Devices include the sensors measuring physical parameters (temperature, pressure, flow, level, voltage) and actuators that perform physical actions (opening valves, starting motors, adjusting setpoints). These devices connect to RTUs or PLCs at remote sites.
How SCADA Works
SCADA systems continuously cycle through data collection, transmission, processing, and display.
Field devices measure physical parameters and report to local RTUs or PLCs. These remote units collect data from multiple sensors, perform any local processing, and transmit information to the central MTU according to configured schedules or in response to significant changes.
The MTU receives data from all remote sites, processes it according to programmed logic, stores historical records, and updates the HMI display. If values exceed defined thresholds, the system generates alarms alerting operators to abnormal conditions.
Operators monitor the process through HMI displays. When intervention is needed, operators issue commands through the HMI. These commands travel to the MTU, which transmits them to the appropriate remote site. The RTU or PLC receives the command and controls local equipment accordingly, then reports the result back to the central system.
This continuous loop of monitoring and control allows a small number of operators to manage extensive infrastructure that would otherwise require staff at every location.
SCADA Applications
SCADA systems control infrastructure critical to modern society.
Electric Power Systems
Power grid SCADA monitors generation plants, transmission lines, substations, and distribution networks. Operators track power flows, voltage levels, and equipment status across the entire grid. SCADA enables remote control of circuit breakers, transformer tap changers, and capacitor banks to maintain grid stability and respond to changing demand.
Without SCADA, electric utilities would need operators stationed at every substation. With SCADA, a single control center can monitor hundreds of substations and thousands of devices across a region.
Water and Wastewater
Water utilities use SCADA to monitor wells, pumping stations, treatment plants, storage tanks, and distribution networks. Operators track water levels, flow rates, pressure, and water quality parameters. SCADA controls pumps, valves, and chemical feed systems to maintain water quality and pressure throughout the distribution system.
Wastewater systems similarly use SCADA to monitor collection systems and treatment facilities, managing pumps and treatment processes to handle varying flows while meeting environmental regulations.
Oil and Gas
Pipeline operators use SCADA to monitor pressure, flow, and temperature along pipelines spanning thousands of miles. Operators can detect leaks, control pump stations, and manage product flow from a central control room.
Refineries and processing plants use SCADA to monitor and control complex industrial processes, maintaining safe operating conditions while optimizing production.
Manufacturing
Industrial SCADA monitors production lines, tracking equipment status, production rates, and quality parameters. Operators can adjust processes remotely, respond to equipment problems, and maintain efficient operations across entire facilities.
Transportation
Traffic management systems use SCADA principles to monitor and control traffic signals, variable message signs, and highway sensors. Transit systems monitor train locations, station conditions, and infrastructure status. Airport systems manage runways, lighting, and ground support equipment.
Security Concerns
SCADA and industrial control systems present significant cybersecurity challenges. Systems designed decades ago without security considerations now connect to networks accessible by attackers.
Historical Security Weaknesses
Early SCADA systems operated on isolated networks with proprietary protocols. Security relied on physical isolation—if attackers couldn't reach the network, they couldn't compromise the system.