Qureshi et al. Res. Trends Int. J. Technol. Innov., January - March 2026, 1 (1) : 27-35
1Department of Computer Science and Engineering, National Institute of Technology Karnataka, Surathkal, India; 2Department of Information Technology, Jadavpur University, Kolkata, India
Article History
Accepted : 27 Feb 2026
Published : 28 Mar 2026
Publication Issue
Volume 1, Issue 1
January - March 2026
Page Number27–35
Legacy SCADA networks were designed as flat, tightly coupled automation architectures, and a single subsystem fault or misconfiguration can cascade across an entire control network as IT-OT convergence accelerates. This paper proposes a segmented automation reference architecture for SCADA systems that enforces continuous device health verification, isolates control zones, and applies policy-based access at the protocol level for Modbus and DNP3 traffic to contain fault propagation. Deployment on a testbed emulating a water treatment SCADA system reduced the reachability of unrelated control zones following a single-point fault by 71 percent, measured via reachability analysis, while adding less than 4ms of latency to control-loop communications.
Keywords - industrial automation, SCADA reliability, control-zone segmentation, industrial control systems, operational resilience
The convergence of information technology and operational technology networks has left flat, tightly coupled SCADA architectures more exposed to fault propagation and misconfiguration cascades, while perimeter-only reliability models remain the default in most industrial deployments. Segmentation principles, already established in enterprise IT resilience engineering, require adaptation for the latency and availability constraints of real-time control networks.
A reference architecture was implemented on a hardware-in-the-loop testbed emulating a municipal water treatment SCADA system, comprising a historian, HMI, and six emulated PLCs. Continuous device health verification was enforced via TPM-backed certificates, and a policy engine mediated all Modbus/TCP and DNP3 requests against a least-privilege access matrix, with control-zone segmentation implemented through software-defined networking flow rules.
Reachability analysis showed a 71 percent reduction in the number of host pairs capable of unintended cross-zone communication following segmentation, and simulated single-point faults were contained to a single control zone in 9 of 10 trial runs, compared with full-network propagation in the baseline flat-network configuration. Control-loop round-trip latency increased by an average of 3.6ms, within acceptable bounds for the simulated process.
Segmentation principles can be adapted to SCADA environments with manageable latency overhead while substantially limiting fault propagation following a single-point failure. Future work will evaluate the architecture against a wider set of OT protocols including IEC 61850.
[1] Zanero S. et al., Resilient segmentation strategies for industrial automation networks, IEEE Transactions on Industrial Informatics, 2020. [2] Stouffer K. et al., Guide to Industrial Control Systems Security, NIST SP 800-82, 2015. [3] Colombo A. W. et al., Industrial cyber-physical systems: A backbone of the fourth industrial revolution, IEEE Industrial Electronics Magazine, 2017. [4] Knapp E. and Langill J., Industrial Network Security, Syngress, 2014.
© 2026 The Author(s). Published by IJEIA Editorial Office. This is an open access article under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Farhan Ahmed Qureshi, Neha Bansal (2026). Segmented Automation Architecture for Improving Operational Resilience of Industrial Control Systems: A Case Study on SCADA Networks. IJEIA, 1(1), 27-35.