OPC Classic vs OPC UA Security

OPC (OLE for Process Control) is the dominant standard for ICS data exchange between SCADA servers, historians, and PLCs. OPC Classic (1996) is built on Windows DCOM/RPC — a complex, historically vulnerable middleware that introduces a large attack surface. OPC UA (Unified Architecture, 2006) replaced DCOM with a platform-independent stack and added TLS transport security and X.509 certificate authentication.

OPC Classic — DCOM Attack Surface

OPC Classic requires Windows DCOM (Distributed COM) which opens dynamic RPC ports (typically 1024–65535) in addition to port 135. This makes firewall policy nearly impossible to enforce at a protocol level. Known DCOM vulnerabilities include:

• MS03-026 — RPC buffer overflow exploited by Blaster/Lovsan worm (2003)
• MS08-067 — Conficker worm used DCOM/RPC for lateral movement through OT networks
• Dynamic port ranges — DCOM callbacks use unpredictable high ports, defeating stateful firewall rules
• Authentication bypass — Several DCOM impersonation vulnerabilities allow privilege escalation on OPC servers

Industroyer/Crashoverride (Ukraine 2016) included an OPC DA (Data Access) module specifically to interact with OPC servers at power substation control networks.

OPC UA — Security Architecture

OPC UA uses a dedicated binary TCP protocol (port 4840) or HTTPS (port 443), eliminating DCOM entirely. Security is built into the specification:

OPC UA Security Modes

• None — no security (default in many deployments, same exposure as OPC Classic)
• Sign — messages are signed but not encrypted
• SignAndEncrypt — TLS with message signing; required for production OT environments

Defences