Open / standardized
IEC 60870-5-101
The serial predecessor to IEC 104, still used for remote telecontrol links where bandwidth is limited.
N/A — serialSerialEncryption: NoLegacy
How it works
Balanced or unbalanced serial links carry the same ASDU structures used by IEC 104.
Communication patternFront-end processor ↔ RTU over serial / radio.
Fact sheet
TransportSerial
PortsN/A — serial
AuthenticationNone in base standard
PurdueLevel 2 – Level 1
EnvironmentsLegacy utility telecontrol over radio / leased line
DevicesRTU, SCADA front-end processor
IndustriesElectric Power, Water / Wastewater
Why should I care?
Understanding IEC 60870-5-101 is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Interrogation
- Commands
- Clock sync
- Counter interrogation
Security concerns
- Radio links may be interceptable
- No authentication
- Monitoring requires front-end processor logs
What normal looks like
- Consistent poll cycles per RTU
What deserves attention
- Link errors clustered in time
- Commands with no operator action recorded
Hunting ideas
- rogue-master-controller
Defensive controls
- Encrypt radio links where feasible
- Correlate commands with operator action logs
Related ATT&CK for ICS techniques
T0855
Sources & further reading