IEC 60870-5-101/104

IEC 60870-5-101 and IEC 60870-5-104 in power automation

These standards define how telemetry and telecontrol data moves between control centres and field equipment in utility environments. IEC 60870-5-101 is typically associated with serial links, while IEC 60870-5-104 carries the same application layer over TCP/IP networks, which makes it more flexible and more exposed to standard IP security concerns.

For operators, the security significance is not the protocol name alone, but the operational role it plays: status reporting, alarms, commands and remote control actions. A weakness in this layer can affect visibility into the grid and the ability to issue trusted commands, so protocol handling, network placement and monitoring matter as much as the application payload.

How the protocol model works

IEC 60870-5-101 is usually deployed where legacy serial connectivity still exists, often in constrained or older substations and remote terminal arrangements. IEC 60870-5-104 preserves the IEC 60870-5 application semantics but transports them over TCP/IP, which simplifies integration with routed networks and remote access paths.

The practical difference is that 104 inherits the exposure profile of IP-based networks. That means segmentation, firewall policy, routing boundaries and monitoring become part of the protocol's security posture, even when the application layer itself is unchanged.

Security implications for telemetry and telecontrol

Telemetry and telecontrol protocols are high-value because they can influence physical processes, not just data. If an attacker can observe or alter control traffic, they may be able to suppress alarms, inject false measurements, replay commands or interfere with operator decisions.

That risk is amplified in environments where command paths are trusted too broadly, where legacy devices accept traffic without strong authentication, or where remote maintenance paths share the same network segments as operational traffic. In practice, the protocol becomes part of a larger OT trust boundary, not a standalone application feature.

Utilities often standardise on protocol-specific hardening guidance, for example IEC 60870-5-104 Telecontrol Security Guide and IEC 62351 Power System Communications Security Guide, because the security controls for power communications need to fit both the protocol and the operational environment.

Where IEC 60870-5-101/104 sits in an OT security architecture

These standards are best understood inside the wider industrial protocol stack, where protocol security depends on zones, conduits, allowlists, change control and telemetry inspection. For organisations managing multiple industrial protocols, Industrial Protocol Security Guide provides a useful broader map of how IEC 60870-5-104 compares with Modbus, DNP3, OPC UA and other common control protocols.

In mature architectures, the goal is not only to permit the protocol to function, but to constrain where it may operate, which systems may originate it, and what normal command patterns look like. That makes the protocol a candidate for tight network policy, protocol-aware inspection and anomaly detection rather than blind trust.

Risk and Threat Considerations

IEC 60870-5-104 is exposed to the same threat patterns that affect other TCP/IP-based OT protocols, including rogue command injection, traffic interception, replay, reconnaissance and misuse of remote access paths. Because it often carries operational commands, compromise can affect both visibility and physical process control.

Failure mechanism: An attacker gains a network position, abuses weakly protected telecontrol sessions, or exploits insufficient segmentation to send unauthorised commands or manipulate telemetry.

Impact: Operators may receive false state information, lose confidence in alarms, or execute unsafe control actions, which can disrupt service and create downstream safety and reliability issues.

Practitioner Guidance

Why practitioners should care: Treat IEC 60870-5-104 as an operational control channel, not just a transport protocol. Its security posture should be evaluated against command authority, network reachability and monitoring quality, because failures here can affect live utility operations.

What to watch for: Watch for overly broad TCP reachability, unexpected command sources, weak boundary controls between enterprise and OT networks, and traffic patterns that do not match the normal operating profile. Those conditions usually signal that the protocol is being exposed more widely than intended.

Related resources from NHI Mgmt Group

• How does IEC 60870-5-104 work?
• What attacks target IEC 60870-5-104?
• How do organisations implement IEC 60870-5-104?
• IEC 60870-5-104