Most of the SCADA servers are on the internal/air-gapped networks. However, consider a possibility where an attacker has gained initial access to an internet facing server and pivoting from the same; he can alter the state of PLCs, read and write values to the controller, and cause havoc. Let's see an example demonstrating this as follows:
We can see in the preceding screenshot that an attacker has gained access to a system on IP range 192.168.174.0 and has already identified and added a route to an internal network range, which is 192.168.116.0.
At this point, an attacker would perform a port scan on the hosts ...
