SCP

What is SCP?

SCP (Secure Copy Protocol) is a method and command-line program for copying files between two computers in encrypted and authenticated form over an SSH connection. SCP appeared in the 1990s as a secure replacement for the unencrypted BSD rcp command and reuses all of SSH’s security: the same port, the same keys and the same encryption. There is no formal RFC for it; its behaviour is effectively defined by the OpenSSH implementation.

In OT networks, SCP is used to transfer configurations, log files or Firmware between Linux-based devices, such as a Firewall, an edge platform or SIEM servers. Many industrial switches and routers support SCP for loading configurations and images.

🧠 How does SCP work?

An SCP transfer takes four steps:

1. The user or a script runs the scp command on the client, with a source and a destination in the form user@host:path.
2. The program opens an SSH session to the remote host, by default on TCP port 22.
3. The host is verified against its known host key and the user logs in (authentication) with a password or, better, an SSH key.
4. The files travel encrypted over the SSH channel, with SSH checking the integrity of every packet.

Characteristics:

• Command-line and scriptable - ideal for repeatable tasks and automation
• Encrypted - protects both the content and the login credentials against eavesdropping
• No extra server needed - wherever an SSH server runs, SCP usually works straight away
• Copy only - no directory listing, renaming or deleting; that is what SFTP is for

The legacy protocol and the move to SFTP

The original scp/rcp protocol let the remote shell expand filenames and wildcards. That made it fragile and hard to secure. In January 2019 researcher Harry Sintonen published a set of flaws in the scp client (CVE-2018-20685, CVE-2019-6109, CVE-2019-6110 and CVE-2019-6111): a malicious server or a man-in-the-middle could overwrite files in the target directory, for example authorized_keys, and hide this with control characters in the progress output. OpenSSH 8.0 (April 2019) shipped mitigations and described the protocol as “outdated, inflexible and not readily fixed”.

A gradual transition followed:

So the scp command lives on, but under the hood it is now an SFTP client with the familiar scp syntax.

🔍 What is the difference between SCP, SFTP, rsync and FTP?

🏭 Where is SCP used in industrial networks?

• Uploading Firmware to edge devices, firewalls, an industrial switch or a router
• Backing up configurations - network equipment such as Cisco IOS can act as an SCP server (ip scp server enable) for retrieving and restoring configurations
• Retrieving log and audit files from an Engineering Station or Historian
• Automated tasks via scripts for backup or reporting, using a key that may only run that task
• Through a Jump Server or Bastion Host - with scp -J the transfer passes through the management zone without the file being stored on the intermediate host
• Commissioning and test environments - quickly moving an image or log file during start-up

Examples:

scp config.xml admin@192.168.0.10:/etc/device/
scp -P 2222 -i ~/.ssh/ot_backup admin@10.10.20.5:/var/log/audit.log ./logs/
scp -J admin@jumphost.ot.local firmware.bin admin@10.20.30.40:/tmp/

Note that scp takes the port with an upper-case -P, whereas ssh uses a lower-case -p.

🔧 How do you use SCP securely in OT?

A practical five-step approach:

1. Take inventory of which devices offer SCP or SSH and which OpenSSH version or firmware they run. Embedded SSH servers in OT equipment often lag years behind; include them in vulnerability management.
2. Choose the transport - use SFTP mode where possible (the default since OpenSSH 9.0). Use -O only for older devices without an SFTP subsystem, and only towards trusted hosts.
3. Control access - separate accounts per person or task, Ed25519 keys with a passphrase, password login disabled and least privilege. Restrict the target path or use a forced command for backup accounts.
4. Restrict the network path - allow port 22 only between the management zone and the target devices through firewall rules and an ACL, in line with network segmentation and the Purdue Model.
5. Verify and log - compare a SHA-256 hash of firmware before and after transfer, use signed firmware where available and send SSH log entries to the SIEM for a complete audit trail through logging.

Typical settings and values:

🔐 Which security risks and requirements apply to SCP?

• Vulnerabilities in SSH implementations - flaws such as Terrapin (CVE-2023-48795) and regreSSHion (CVE-2024-6387) hit the SSH protocol and the OpenSSH server respectively, which SCP also relies on; track them through patch management
• Abuse for lateral movement - attackers with stolen keys use SCP to move tools or stolen data, and ransomware groups work the same way
• Unmanaged keys - private keys without a passphrase on shared engineering stations are a well-known weak spot
• IEC 62443-3-3 - SCP supports system requirements such as SR 1.1 (identification and authentication), SR 3.1 (communication integrity) and SR 4.1 (confidentiality), provided access control and logging (SR 2.8) are set up properly
• ISO 27001 and NIS2 - in the Netherlands the Cyberbeveiligingswet, in force since 15 August 2026, requires essential and important entities to take appropriate measures for secure network and system access; encrypted, logged file transfer is part of that

SCP is powerful but should be part of a manageable and auditable access flow, within defined zones of the IEC 62443 architecture.

❓ Frequently asked questions

Is SCP still safe to use?

SCP is safe to use as long as the client and server run current OpenSSH versions. Since OpenSSH 9.0 the scp command uses the SFTP protocol by default, which removes most of the known weaknesses of the legacy scp/rcp protocol. Only the -O option towards an untrusted server calls for extra caution.

Which port does SCP use?

SCP uses the same port as SSH, TCP port 22 by default. You specify a different port for scp with the upper-case -P option. There is no separate SCP port, because SCP always runs over an SSH connection.

Can SCP resume an interrupted transfer?

SCP cannot resume an interrupted transfer and starts again from the beginning. For large files over unstable OT links, SFTP clients with a resume function or rsync over SSH are better suited. rsync also sends only the changed parts of a file.

How do I use SCP on Windows?

SCP has shipped with the Windows OpenSSH client since Windows 10 (version 1809) and Windows Server 2019, so scp works directly in PowerShell. Graphical alternatives are WinSCP and the PuTTY utility pscp. On engineering stations it is wise to manage the installation and keys centrally.

When should you choose SFTP instead of SCP?

SFTP is the better choice for interactive management, browsing directories, changing permissions or resuming transfers. SCP remains handy for a single quick copy or a simple script. Because SCP now uses SFTP itself, the difference is mainly one of functionality and convenience.

Does SCP work through a jump server?

SCP works through a jump server with the -J option, available since OpenSSH 8.0. The connection then passes through the jump host to the target device without the file being stored on the intermediate host. That fits an architecture with a management zone between IT and OT.

📌 In summary

SCP is a simple, scriptable and encrypted way to transfer files over SSH within OT networks, provided you combine current OpenSSH versions, key authentication, segmented network paths and logging. Since OpenSSH 9.0 scp uses SFTP under the hood, so you keep the familiar syntax without the weaknesses of the legacy protocol.