IEC 104 is a communication protocol used for telecontrol in electrical power systems, especially between control centres and remote terminal units. It carries operational commands, measurements and status data over IP networks, and is commonly used in industrial control environments where message integrity, authentication and network segmentation affect operational safety.
How IEC 104 Works in Power Telecontrol
IEC 104 is used to move supervisory control traffic between a control centre and field equipment over IP networks. Its value comes from carrying commands, measurements, and status updates with low latency, but that same openness means the protocol depends heavily on the surrounding network trust boundary.
Because IEC 104 is commonly deployed in operational technology environments, the protocol itself is only one part of the security picture. The communication path, endpoint hardening, and segmentation around it often matter as much as the frame structure and application data that IEC 104 carries.
Why IEC 104 Security Matters
IEC 104 traffic can directly influence physical operations, so integrity failures are more serious than a simple data loss event. A forged command, altered measurement, or suppressed status message can mislead operators or affect process control decisions, which is why telecontrol links need strong protection against spoofing, tampering, and unauthorized access.
The protocol was designed for industrial reliability, not for modern hostile networks, so deployments often inherit assumptions about trusted links and controlled endpoints. IEC 60870-5-104 Telecontrol Security Guide is a useful starting point when you need protocol-specific defensive context for those assumptions.
Common Exposure Points and Control Gaps
IEC 104 is typically exposed through TCP-based communications, so weak perimeter filtering, flat OT networks, and permissive remote access paths can broaden attack opportunity. If the protocol is reachable from untrusted zones, an attacker may be able to probe masters, remote terminal units, or supporting gateways without first defeating an application-layer defense.
Exposure also comes from inconsistent device inventories and incomplete protocol visibility. Operators often know the control network exists, but not every relay, gateway, engineering workstation, or maintenance path that can reach it. That makes allowlisting, flow control, and protocol-aware monitoring especially important for reducing unnecessary exposure.
Protection, Monitoring, and Response for IEC 104
Defence usually starts with reducing who can speak IEC 104 at all, then adding cryptographic protection where the environment supports it. IEC 62351 Power System Communications Security Guide is the most directly relevant reference for securing related power-system communications, including authenticated and encrypted approaches for telecontrol links.
For broader industrial network design, OT Security Guide helps place IEC 104 inside the larger segmentation and monitoring model that protects SCADA and control traffic. In practice, defenders look for unexpected masters, abnormal command rates, new endpoints on the control path, and protocol behaviour that does not match the normal operating pattern.
After any suspected compromise, review not only the network logs but also the operational effects. Validate whether commands were issued, measurements were altered, alarms were suppressed, or operator decisions could have been influenced by false telemetry. That post-event review is often necessary because in control environments the most dangerous impact is not just loss of connectivity, but loss of trustworthy state.
Risk and Threat Considerations
IEC 104 becomes risky when it is treated as a trusted operational channel rather than a protocol exposed to adversarial access. The main dangers are command injection, telemetry manipulation, replay-like abuse of stale process data, and unauthorized viewing of operational state across weakly segmented networks.
Failure mechanism: An attacker or misconfigured intermediary reaches the telecontrol path, then abuses weak authentication, permissive routing, or poor protocol filtering to send or alter operational messages.
Impact: Operators may act on false process data, execute unintended commands, or lose confidence in the integrity of the control system, which can create safety, availability, and recovery consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | IEC 104 security depends on restricting which zones can exchange control traffic. |
| IA-2 — Identification and Authentication (Organizational Users) | Control operators and admins accessing IEC 104 environments need authenticated access. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | IEC 104 abuse is often detected through review of command, alarm, and access logs. | |
| Recommendation — Enforce flow restrictions so only approved IEC 104 communications can cross trust boundaries. Authenticate operators before granting access to IEC 104 control and monitoring systems. Review telemetry and command logs for anomalous IEC 104 activity and follow up on alerts. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | IEC 104 protection relies on managed routing, filtering, and network segmentation. |
| CIS-13 — Network Monitoring and Defense | Protocol-level monitoring is central to spotting abnormal IEC 104 behaviour. | |
| Recommendation — Harden and segment the network paths that carry IEC 104 communications. Monitor IEC 104 sessions for unusual masters, commands, and traffic patterns. | ||
| NIST Zero Trust (SP 800-207) | SC-7 — Micro-segmentation and Perimeter Controls | Zero trust principles directly support limiting implicit trust in IEC 104 paths. |
| Recommendation — Apply zero trust segmentation so IEC 104 traffic is explicitly authorized and isolated. | ||
Practitioner Guidance
Why practitioners should care: IEC 104 security is not just a network hygiene issue, it is a control integrity issue. The practical question is whether the protocol is confined to the smallest possible trust zone and whether every allowed path is genuinely required for operations.
Common misunderstanding: Many teams assume that because IEC 104 is an industrial protocol, it is inherently acceptable to leave it reachable inside a flat OT network. In reality, segmentation, explicit allowlisting, and monitoring are often what keep a normal telemetry protocol from becoming an easy control-path abuse channel.
Practitioner takeaway: Treat IEC 104 as a high-consequence operational interface and verify its exposure, trust boundaries, and monitoring as part of routine OT security review.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org