The Cyber-Physical Attack Surface of Legacy Scada Networks: A Systematic Review of Vulnerabilities, Threats, and Detection Gaps in Critical Infrastructure

Abstract

Legacy Supervisory Control and Data Acquisition (SCADA) networks remain the operational backbone of the electric power, water treatment, and oil-and-gas sectors, yet they were engineered in an era that prioritized deterministic availability and physical safety over information security. The progressive convergence of information technology (IT) and operational technology (OT) has dissolved the air gaps that once isolated these systems, exposing an attack surface for which their aging protocol stacks were never designed. Field-level communication standards such as Modbus and DNP3 typically transmit control directives without encryption, authentication, or message integrity, allowing an adversary who reaches the network to forge, replay, or manipulate commands at will. The defining hazard of this domain is the cyber-physical attack, in which a purely digital intrusion is translated into tangible physical damage, service disruption, or threats to human life. Against this class of threat, conventional signature- and rule-based intrusion detection is structurally inadequate, missing novel and stealthy manipulations while generating unsustainable false-alarm volumes. This review systematically synthesizes the vulnerability landscape, a taxonomy of cyber-physical threats, landmark incidents including Stuxnet, the 2015 Ukrainian grid attack, TRITON, and Maroochy, the protocol-level weaknesses of legacy assets, and the resulting detection gap. Drawing together the industrial-control and applied cybersecurity literature, it argues that intelligent behavioural anomaly detection offers the most credible path toward resilient protection of critical infrastructure