SCADA Cloud Integration

Secure SCADA Cloud Integration on AWS and Azure

Get operational data from SCADA systems and historians into AWS or Azure for reporting, analytics and sharing, with an architecture that lets the cloud read from your control system but gives nothing on the internet a way to write to it.

Patterns

Integration Patterns

Export through a DMZ

SCADA or historian data replicated to a server in an OT DMZ, which pushes it to the cloud. The control network never accepts a connection from outside, and the DMZ is the only place that talks to the internet.

MQTT from the edge

Edge gateways publish data over MQTT, including Sparkplug B, to AWS IoT Core or Azure IoT Hub, using TLS and per-device certificates, with store-and-forward so a link outage doesn't lose data.

Unidirectional gateways

Where the risk assessment calls for it, a data diode or unidirectional gateway physically prevents any data flowing back into the control system.

Cloud-hosted SCADA

Running SCADA servers on cloud virtual machines can make sense for some monitoring-heavy, geographically spread systems. It also puts the internet in your control path, so it needs a frank assessment of availability, latency, communications and security before anyone commits.

Method

How I Approach a Cloud Integration

  1. Start with the use cases

    Who needs which data, how fresh it must be, and what decisions it supports. This shapes everything else, including cost.

  2. Agree the data model

    Tag naming, units, quality flags and asset context agreed up front, so the data is usable when it lands.

  3. Design the security

    The cloud tenancy and every connection to it treated as zones and conduits in your IEC 62443 model, with outbound-only flows from OT.

  4. Choose platform services

    On AWS, typically IoT Core, IoT SiteWise, Timestream, S3, Lambda and QuickSight; on Azure, IoT Hub, Event Hubs, Azure Data Explorer and Power BI. Chosen to fit the cloud and skills your organisation already has.

  5. Forecast the cost

    Messages, storage, queries and data transfer modelled before anything is built, so the running cost is known and sustainable.

  6. Build, test and operate

    Infrastructure as code, monitoring, and clear ownership and support arrangements agreed before go-live.

Security

Security Principles

  • Nothing in the cloud can initiate a connection into the control network
  • Outbound flows leave from a DMZ, not from control system servers
  • Device and service identity based on certificates, with least-privilege access policies
  • Encryption in transit and at rest, and logs your security team can see
  • Control from the cloud only where a risk assessment has explicitly accepted it
  • Data stores that hold business-critical data for a SOCI Act asset may fall within its risk management program, so design with that in mind

The wider cloud architecture work is described under Digitalisation & Cloud, and Geo SCADA-specific integration under Geo SCADA consulting.

FAQ

Frequently Asked Questions

Is it safe to connect SCADA to the cloud?

It can be, if the design keeps control and data separate: data flows outbound from a DMZ, nothing in the cloud can initiate a connection into the control network, and the whole path is treated as a conduit in your IEC 62443 zone model. The risk comes from shortcuts, such as a cloud agent installed directly on a SCADA server.

Can we control equipment from the cloud?

Technically yes, but it puts the internet and a cloud provider in your control path. A common pattern is to keep supervisory control on premises and use the cloud for monitoring, reporting and analytics. If cloud control is wanted, it needs a specific risk assessment and strong compensating controls.

Should we use AWS or Azure?

Usually whichever your organisation already runs and supports. Both provide mature IoT, time-series and analytics services, and the integration patterns are the same.

What does SCADA cloud integration cost to run?

It depends mainly on message volumes, how much data is stored and for how long, and how it is queried. Modelling that before you build is part of the design, so the first invoice holds no surprises.

Can Geo SCADA send data to AWS or Azure?

Yes. Geo SCADA data can be extracted through its SQL and .NET interfaces, or published through an edge or DMZ component, using the same patterns described above.

Related

Related Services