SCADA cyber security: the link you do not own
Supervisory systems talk to places nobody visits, over cellular, radio or a leased line that belongs to somebody else. Telemetry that stays meaningful for decades crosses that path today. QS-WAN protects the link with post-quantum key establishment and ships the gateway configured, because there is no rack and no local IT at the far end.
Whatever goes there has to arrive working and stay quiet for years.
Long-lived data on somebody else’s path
SCADA is a supervisory layer with a long reach. Pumping stations, substations, reservoirs, roadside cabinets: sites with no staff, reached over a link the operator rents rather than owns, often cellular, sometimes radio.
The data that crosses it looks dull and lasts a long time. Setpoints, alarm thresholds, network topology and consumption patterns stay meaningful for decades, which makes them exactly the kind of traffic worth capturing now and reading later.
Meanwhile the far end resists everything an IT team takes for granted. No rack, no console, no second engineer, and a site visit that costs a day. Whatever is installed there has to arrive configured and behave for years without attention.
The link is rented
A cellular or leased path can be observed by whoever runs it, and by anyone who compromises them. Encryption is the only control you own on that hop.
Capture now, decrypt later
Traffic recorded today can be stored and opened when tools improve. For telemetry with a thirty year life, that is a real risk rather than a slogan.
Nobody is there to fix it
Anything needing hands on site competes with a van, a driver and a day. Configuration has to happen before the box leaves.
A configured gateway at the far end, and one map at the centre
QS-WAN runs a private network from one console. For a supervisory network spread over remote sites, three parts carry it.
Hardware that arrives ready
We ship the gateway configured, so the person at the cabinet plugs it in rather than commissions it. It also runs as software on a host you already have, where a site has one.
Post-quantum on the rented link
Key establishment between device, gateway and control plane is post-quantum by default, aligned with FIPS 203, FIPS 204 and CNSA 2.0, and hybrid by design. Whoever records the link today gains nothing later.
Reachability as a drawing
Each site is a segment, and a permitted path is an edge you can switch off from the centre. A VLAN set to zero trust stays default deny, so a contractor connection opened last spring does not survive the summer by accident.
Offline is normal, not an error
Links drop. Changes are recorded centrally and converge when the gateway comes back, and the console shows which gateways are online, so you know what is true right now.
Runs where you decide
License the control plane onto your own infrastructure, take gateways we ship configured, or let us host it. Networks that must not touch the internet keep the console inside the boundary. More on air-gapped networking.
The questions that follow a remote site
Auditors and insurers ask about the far end first, because it is where the assumptions are. The console answers without a site visit.
What is at each site, and is it online?
Each gateway, its segments and its state, so the map shows reachability rather than intention.
How is the link protected?
Post-quantum key establishment by default, hybrid by design, with the cryptographic inventory documented by subsystem.
Who can reach the site, and from where?
User profiles, devices and one certificate per gateway membership, revocable centrally.
Is the configuration checked?
Assessments per gateway return pass, fail, partially satisfied or not tested, next to a risk score built from 19 indicators.
The thing to check before you report. A green confirmation means the change was recorded centrally. A gateway on a sleeping cellular link applies it when it reconnects, so read the online state next to the record.
What this does not reach
SCADA covers a lot of ground, most of it outside a network platform. The boundary is worth stating.
The RTU and the PLC
Nothing is installed on field devices, so nothing here patches them or reads their process values.
The carrier
The cellular or leased link stays your provider’s. What changes is that what crosses it is unreadable to them.
Nobody is watching for you
QuantumNova is a product, not a managed service. The evidence and the score are produced for your team to read.
Sites it does not run
A remote site without a gateway is outside the platform’s view. It cannot describe separation it does not enforce.
Start with the site that is hardest to visit
That is usually where the oldest assumptions live. A demonstration is free, and it works best with one real site on the table.
NEWSLETTER
Get weekly tips, product news and early access, straight to your inbox.