User authentication and authorization in SCADA systems - Step-by-Step Execution

Process Flow - User authentication and authorization

User submits credentials

↓

System verifies identity

↓

Check user rights

↓

Authorization granted?

↓

Access SCADA

↓

Log user activity

User provides credentials, system checks identity (authentication), then checks permissions (authorization) before granting access.

Execution Sample

SCADA systems

1. User inputs username and password
2. System checks credentials against database
3. If valid, system checks user role
4. If role permits, access granted
5. Else, access denied

This process verifies user identity and permissions before allowing SCADA system access.

Process Table

Step	Action	Input	Check/Condition	Result	Next Step
1	Receive credentials	username=operator, password=1234	None	Credentials received	Verify credentials
2	Verify credentials	operator/1234	Match in user database?	Yes	Check authorization
3	Check authorization	User role=operator	Role has access rights?	Yes	Grant access
4	Grant access	N/A	N/A	Access granted to SCADA system	Log activity
5	Log activity	User=operator, action=login	N/A	Login recorded	End
6	End	N/A	N/A	Process complete	N/A

💡 Process ends after logging user activity or denying access if checks fail

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
username	None	operator	operator	operator	operator	operator
password	None	1234	1234	1234	1234	1234
credentials_valid	False	False	True	True	True	True
user_role	None	None	operator	operator	operator	operator
access_granted	False	False	False	True	True	True

Key Moments - 3 Insights

Why does the system check authorization after authentication?

Authentication confirms identity (Step 2), but authorization (Step 3) checks if the user has permission to access specific SCADA functions. Both are needed to secure the system.

What happens if credentials do not match the database?

If credentials fail verification (Step 2), the process stops and access is denied. This is why 'credentials_valid' remains False and no further steps occur.

Why is user activity logged after access is granted?

Logging (Step 5) records who accessed the system and when, helping track usage and detect unauthorized actions later.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'credentials_valid' after Step 2?

A False

B None

C True

D operator

💡 Hint

Check the 'Result' column at Step 2 and variable_tracker for 'credentials_valid' after Step 2

At which step does the system decide if the user can access the SCADA system?

A Step 3

B Step 5

C Step 1

D Step 6

💡 Hint

Look at the 'Action' and 'Result' columns in the execution_table for where access is granted

If the user role did not have access rights, what would happen in the execution table?

A Access would be granted at Step 4

B Process would stop after Step 3 with access denied

C User credentials would be rechecked

D User activity would be logged before access check

💡 Hint

Refer to the flow in concept_flow and the 'Check authorization' step in execution_table

Concept Snapshot

User authentication verifies identity by checking credentials.
Authorization checks if the user has permission to access resources.
Both steps are required before granting access.
Logging user activity helps track system usage.
If authentication or authorization fails, access is denied.

Full Transcript

User authentication and authorization in SCADA systems involves first receiving user credentials like username and password. The system then verifies these credentials against a user database to confirm identity. If the credentials are valid, the system checks the user's role to determine if they have permission to access the SCADA system. If authorized, access is granted and the user's login activity is logged for security tracking. If any check fails, access is denied and the process stops. This ensures only valid and permitted users can operate the SCADA system.

Practice

1. What is the main purpose of user authentication in a SCADA system?

easy

A. To backup system data

B. To confirm the identity of a user

C. To monitor system performance

D. To control what actions a user can perform

Solution

1. Step 1: Understand authentication concept

   User authentication is about verifying who the user is.

2. Step 2: Differentiate from authorization

   Authorization controls permissions, not identity confirmation.

3. Final Answer:

   To confirm the identity of a user -> Option B

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication = Who you are, Authorization = What you can do [OK]

Common Mistakes:

• Confusing authentication with authorization
• Thinking authentication controls permissions
• Mixing system monitoring with user identity

2. Which of the following is the correct syntax to define a user role with read-only access in a SCADA system configuration file?

easy

A. role read_only { permissions: ["read"] }

B. role read_only = permissions: read

C. role: read_only { access = read }

D. read_only role { permissions = read }

Solution

1. Step 1: Identify correct role syntax

   The correct syntax uses 'role' keyword, role name, and permissions list in braces.

2. Step 2: Check option formats

   role read_only { permissions: ["read"] } correctly uses braces and array syntax for permissions.

3. Final Answer:

   role read_only { permissions: ["read"] } -> Option A

4. Quick Check:

   Correct role syntax uses braces and permission array [OK]

Hint: Look for braces and array syntax for permissions [OK]

Common Mistakes:

• Using '=' instead of ':' for permissions
• Missing braces around role definition
• Incorrect order of keywords

3. Given the following SCADA user permissions code snippet:

user = { name: "operator", roles: ["read_only", "control"] }
roles = {
  read_only: { permissions: ["read"] },
  control: { permissions: ["write", "execute"] }
}

What permissions does the user "operator" have?

medium

A. ["read"]

B. ["write", "execute"]

C. ["read", "write", "execute"]

D. ["read", "write"]

Solution

1. Step 1: Identify roles assigned to user

   User "operator" has roles "read_only" and "control".

2. Step 2: Combine permissions from both roles

   "read_only" grants ["read"], "control" grants ["write", "execute"]. Combined permissions are ["read", "write", "execute"].

3. Final Answer:

   ["read", "write", "execute"] -> Option C

4. Quick Check:

   Combine all role permissions for user [OK]

Hint: Add permissions from all user roles together [OK]

Common Mistakes:

• Selecting permissions from only one role
• Forgetting to merge permissions
• Confusing role names with permissions

4. A SCADA system admin tries to assign a user a role using this command:
assign_role user1 admin
But the system returns an error: "Role 'admin' not found." What is the most likely cause?

medium

A. The role 'admin' is not defined in the system

B. The user 'user1' does not exist

C. The command syntax is incorrect

D. The system is offline

Solution

1. Step 1: Analyze error message

   Error says "Role 'admin' not found," indicating the role is missing.

2. Step 2: Check command and user existence

   Command syntax looks correct and error does not mention user, so user likely exists.

3. Final Answer:

   The role 'admin' is not defined in the system -> Option A

4. Quick Check:

   Error message points to missing role [OK]

Hint: Check error message for missing role or user [OK]

Common Mistakes:

• Assuming user does not exist without checking
• Blaming command syntax without error details
• Ignoring error message content

5. In a SCADA system, you want to restrict a user so they can only read data but not control devices. Which approach best achieves this?

hard

A. Disable user authentication for faster access

B. Assign the user multiple roles including control

C. Grant the user admin privileges temporarily

D. Assign the user a role with only read permissions

Solution

1. Step 1: Understand requirement

   User must only read data, no control allowed.

2. Step 2: Choose role assignment

   Assigning a role with only read permissions restricts actions properly.

3. Step 3: Evaluate other options

   Assigning control roles or admin privileges contradicts restriction; disabling authentication is insecure.

4. Final Answer:

   Assign the user a role with only read permissions -> Option D

5. Quick Check:

   Restrict actions by role permissions [OK]

Hint: Use roles with minimal permissions to restrict users [OK]

Common Mistakes:

• Giving users more permissions than needed
• Disabling authentication to simplify access
• Using admin roles for normal users