IEC 60870-5-104 is a telecontrol protocol used to send supervision and control data between industrial devices, substations, and utility control systems over TCP/IP networks. It carries commands, measurements, alarms, and status updates for SCADA-style operations, so it is common in power and critical infrastructure environments.
The protocol matters because it often sits close to real operational control. If an attacker can impersonate a peer, intercept traffic, or tamper with session setup, they may influence monitoring or command execution. That is why TLS protection and certificate validation are important when IEC 60870-5-104 is wrapped in encryption. Defenders usually reduce risk by segmenting OT networks, limiting access to trusted hosts, validating certificates correctly, and monitoring for unexpected protocol sessions or control messages.