IEC 60870-5-104

How IEC 60870-5-104 Works in Utility Telecontrol

IEC 60870-5-104 is designed to move SCADA control and telemetry between supervisory systems and field equipment over TCP/IP. That makes it a transport wrapper for operational commands, status updates and process data, rather than a business IT protocol, so its security assumptions are tied to industrial availability and control integrity.

The protocol’s value is that it extends telecontrol beyond serial-only links into IP networks, which improves integration but also expands the exposed attack surface. In practice, the same path that carries routine telemetry can also carry commands that affect physical processes if access is not tightly constrained.

Why Exposure Is Dangerous

When an IEC 60870-5-104 interface is reachable by the wrong party, the danger is not limited to data leakage. An exposed session can provide reconnaissance into utility operations, reveal device behaviour, and create a pathway for unauthorised command traffic that influences field assets.

That is why exposure has to be understood as both a cyber and operational safety issue. OT Security Guide is a useful reference for the segmentation and industrial protocol context that usually surrounds this protocol.

Because IEC 60870-5-104 often sits in environments where legacy systems and remote operations coexist, weak network boundaries can turn a normal supervisory link into a high-value control path. The risk increases when protocol access is treated like ordinary IT traffic instead of a governed operational channel.

How Organisations Assess and Reduce Exposure

Exposure assessment starts with knowing where the protocol is used, which links are routable, and whether any instance is reachable from corporate networks, remote access paths or the internet. Asset inventory matters because utility environments often contain long-lived assets whose protocol exposure is poorly documented.

For control design, utility teams usually rely on segmentation, restricted conduit design and tightly scoped remote access. NIST SP 800-53 Rev 5 Security and Privacy Controls provides a broad control basis for access control, auditability, and configuration discipline, while NIST Cybersecurity Framework 2.0 helps organise governance across identify, protect, detect, respond and recover.

Because the protocol is operational, vendors and operators should also compare live deployments with the relevant vendor advisory or product guidance before making remediation decisions. Where direct containment is more practical than immediate change, NIST SP 800-207 Zero Trust Architecture supports the principle of verifying every access path instead of assuming an internal network is safe.

Monitoring, Detection and Response Expectations

Security monitoring for IEC 60870-5-104 should focus on who is opening sessions, which commands are being issued, and whether traffic patterns match expected operational behaviour. Baseline awareness is important because unusual command frequency, new source systems or out-of-hours access can indicate misuse or compromise.

Detection is especially valuable because this protocol can be used for both legitimate control and hostile reconnaissance. MITRE ATT&CK Enterprise Matrix is helpful for mapping adversary behaviour such as discovery, credential abuse and lateral movement into the broader response workflow, even when the ultimate target is an OT environment.

After a suspicious event, operators should review command logs, session provenance, engineering workstation access and any changes to process state or alarm behaviour. If compromise is suspected, identity-bearing materials that enable access, including operator credentials or service account material used for supervision links, may need review and rotation.

Practitioner Guidance

Why practitioners should care: IEC 60870-5-104 is not just another network protocol, because its payload can directly affect physical operations. Treat every reachable endpoint as a control plane exposure, not a routine application interface.

What to watch for: The most important warning signs are unexpected source hosts, newly exposed routes, repeated command attempts, and telemetry patterns that stop looking operationally normal. Those signals often appear before a full loss of control or before an attacker tries to blend into legitimate supervisory traffic.

Practitioner takeaway: The safest posture is to minimise reachable interfaces, verify every session origin, and assume that any exposed telecontrol channel deserves the same scrutiny as a high-impact production control path.

Related resources from NHI Mgmt Group

• Who is accountable for ISO/IEC 42001 evidence and AI access control?
• Why does ISO/IEC 27001:2022 matter for IAM and NHI programmes?
• Why do organisations choose ISO/IEC 27001 when they already have other security frameworks?
• What is the difference between ETSI TS 119 461 and ISO/IEC 30107 in identity proofing?