performing-scada-hmi-security-assessment

name	performing-scada-hmi-security-assessment
description	Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines. . Use when working with performing scada hmi security assessment.
domain	cybersecurity
tags	["ot-security","ics","scada","hmi","security-assessment","vulnerability","iec62443","nist-800-82"]
subdomain	ot-ics-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Performing Scada Hmi Security Assessment

Overview

Cybersecurity skill for performing scada hmi security assessment. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing scada hmi security assessment"

• "Perform security assessments of SCADA Human-Machine Interface (HMI) systems to i"

• When assessing the security posture of HMI systems in SCADA/DCS environments

• When evaluating web-based HMI interfaces for common web vulnerabilities

• When auditing HMI authentication, authorization, and session management

• When testing communication security between HMIs and PLCs/RTUs

• When preparing for IEC 62443 or NERC CIP compliance assessments

Do not use for testing HMIs in active production without a maintenance window and rollback plan, for PLC-level protocol analysis (see performing-s7comm-protocol-security-analysis), or for general web application testing on non-OT systems.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• HMI system inventory with vendor, version, and network configuration details
• Lab or test environment mirroring production HMI setup (preferred for active testing)
• Authorization from plant operations for testing during maintenance windows
• NIST SP 800-82 and IEC 62443 security requirements documentation
• Network capture capability on HMI-to-PLC communication segment

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}