Securing an Ignition SCADA system: a checklist for water utilities.

Artek engineering team · October 2026

Why it comes up now

Under America’s Water Infrastructure Act, community water systems serving more than 3,300 people must assess the risk and resilience of their systems, including their electronic and process control systems, and update that assessment every five years. A SCADA platform past the end of vendor support is hard to defend in that assessment, because known vulnerabilities in it will not be patched.

1. Start from zones and conduits

Group assets by the security they need (the plant control network, the SCADA servers, the business network) and allow only named paths between them. This is the zone-and-conduit model from ISA/IEC 62443, and it turns “we have a firewall” into a design someone can review. Write down every path that is allowed and why.

2. Put a DMZ between the plant and the business network

The usual pattern is an industrial DMZ with two firewalls, one facing the control network and one facing the business network, and no traffic that passes through both without stopping in the DMZ. Gateways close to the process talk to the controllers. Reporting, historians and business users get their data from the DMZ, not by reaching into the control network.

3. Treat remote access as its own path

Remote and administrative access are usually the weakest and least documented paths. Give each its own entry in the design: a jump host, an identity-aware proxy or a VPN with access rules. A gateway web port exposed to the internet is not acceptable. Vendor sessions should be opened when needed and logged, not left open.

4. Sign on through your directory

Ignition can authenticate users through Active Directory or Microsoft Entra ID, so staff use their existing accounts and leavers lose access when IT disables them. Use roles to limit who can change a setpoint or acknowledge an alarm, and turn on an audit profile so changes are recorded with who made them. We set this up on a California wastewater agency’s SCADA.

5. Secure the device connections

• OPC UA: use the Sign or SignAndEncrypt security mode with a SHA-2 policy, and certificates your organization issues and renews.
• Default credentials: change the OPC UA module’s default credentials, and update the gateway’s own connection to match.
• MQTT, if you use it: TLS on every connection and topic permissions that limit each site to its own data.

6. Harden and maintain the gateway

• Enable TLS on the gateway and run it under a least-privilege service account.
• Keep credentials in a secrets provider, not in configuration files.
• Verify a module’s file hash and signing certificate before installing it.
• Stay on a supported long-term release (8.3 is supported through 2030) and decide patch timing in operations, not automatically. NIST SP 800-82 Rev. 3 makes the same point: control systems have safety and reliability limits that IT practices do not account for.
• Test changes on a copy of the system before they reach production.

What to ask for in a design review

A zone diagram with every allowed path named, the remote and administrative access paths drawn as their own conduits, proof that default credentials were changed, where audit records are kept and who can read them, and a restore that has actually been tested. If a design cannot show these, the gaps are where the work is.