- The document discusses challenges facing utilities such as aging infrastructure, workforce transitions, reliability pressures, and increasing cyber security threats. It also covers opportunities from digital substation technologies including process bus, cyber security features, teleprotection, phasor measurement units, and wireless communication. - The presentation discusses definitions of cyber security for utilities and common vulnerabilities in protection and control systems like default passwords, heterogeneous networks, and penetration testing tools. It also summarizes Abb Power Grid's approach to cyber security including secure architectures, product hardening, and lifecycle security services. - Specific cyber security features for Abb's digital substations are explained including protocol hardening, role-based access control, security event logging, and configuration guidelines for hardening

1. —JULIO OLIVEIRA, ABB POWER GRIDS – GRID AUTOMATION, MAY 15TH
Cyber security for digital substations: Protection and control systems
CLASS 2018 – 3ª Conferência Latino Americana de Segurança em SCADA

2. —
Current challenges and changes facing utilities
May 14, 2018 Slide 2
Aging infrastructure
Legacy systems with static or
eletromechanical relays, and even
first microprocessor based relays
Workforce in transition
Maintenance and operation
engineering groups members
elegible for retirement in next few
years.
Reliability
There´s increasing pressure to
continually improve reliability
and customer satisfaction.
Spending justification
Revenue challenges and regulatory
inspection will drive the
costs/expenditure.
Cyber security
Attacks on critical infrastructure are
increasing in terms of regularity and
sophistication.
Disruptive technologies
Digitalization techniques for
substation automation via IEC
61850, concerns about cyber security
and asset management demands
attention by the utilities part.
Changes in business model
New players are entering in energy
market, and among them are investors
who are non-utilities companies. This
group will be responsible by 20% of
transmission and distribution around the
world until 2020.
Training
Network computers and its
protocols, topologies and
communication redundancy.
Costs
Minimize→ Optimize
Performance
Exceed→ Meet or beat
Risks
Avoid → Manage
$

3. —
Beyond the redundancy, synch and performance …
Meet the standards
May 14, 2018 Slide 3
Features and resources included

4. —
Digital substations concepts
What´s cyber security for utilities and its impacts growing?
A substation automation system risks
IEC 61850-9-2LE: Actions taken for process bus hardening
Protection and control cyber security features
May 14, 2018 Slide 4
Cyber security for digital substations
Agenda

5. —
Cyber security for digital substations
Digital substations concepts

6. —
Intelligent
substation
HMI
SDM600
Data
manager
How the digitalization is understood by the utilities
Digital substation concepts and scenarios
May 14, 2018 Slide 6
Station bus
Process bus
Mobile workforce
management
CALM
Platform
SCADA NCC
Disturbanc
e records
Operation
Network control center
Super PDC
PMUs
SCADA Level 2
RTU Gateway Level 2
Cyber security
Merging
units
Ability
Primary apparatus sensing
Control room perimeter
Teleprotection over
MPLS with FOX615
1
2
3
4
7
x
Opportunities to explore with digital substations
- Process bus
- Cyber security
- MPLS/TP teleprotection
- PMUs
- Asset management
- MESH industrial Wifi communication
- Primary apparatus sensing
“A digitalized substation (no digital substation) doesn´t considers the gray areas!”
Asset Management
PMU and PDCs
WiFi Industrial
6
5

7. —
Cyber security for digital substations
What´s cyber security for utilities and its impacts growing?

8. —
Definition and vulnerabilities
What´s cyber security for utilities and its impacts growing?
May 14, 2018 Slide 8
“Measures taken to protect substation automation systems and communication networks against unauthorized access, attacks, disruption or loss”
Cyber security
Vulnerabilities
Vulnerability is a weakness in a product that could allow an attacker to compromise the integrity, availability or confidentiality of that product.
Examples:
• allows an attacker to execute commands as another user and conduct a denial service
• allows an attacker to access data from a other user or pose as another entity
Heterogeneous nature of SAS nets has complicated tasks such as:
• revoking staff credentials and changing default passwords
Factory default accounts often remain unchanged after handover from manufacturer to customer.
• may even remain unchanged for their entire lifetime
Unchanged factory default accounts make it easy for an attacker to access devices in a short time.
• without the need for any special skills and special knowledge
User accounts in industrial enviroments

9. —
Legal and illegal penetration tools – the risks of not being up to date
What´s cyber security for utilities and its impacts growing?
May 14, 2018 Slide 9
– Legal and illegal penetration and hacking tools are freely
available today
– Penetration testing software
– Vulnerability Scanner
– Network discovery and security auditing
– Internet of Things (IoT)
– You can even buy Malware as a service !
The increasing risks Penetration tools
NMAP Metasploit
Shodan Nessus

10. —
Vulnerabilities in protection and control systems
What´s cyber security for utilities and its impacts growing?
May 14, 2018 Slide 10
ICS vulnerability – disclosures by year
Source: https://scadahacker.com/
Source: 2016 ICS vulnerability trend report
By FireEye

11. —
Grid automation cyber security approach
What´s cyber security for utilities and its impacts growing?
May 14, 2018 Slide 11
– Secure system architecture
– Product and system hardening
– Service offering to keep the cyber security over
the lifetime
Defence in depth

12. —
Cyber security for digital substations
A substation automation system risks

13. —
A substation automation system risks
May 14, 2018 Slide 13
Threats and substation control layers

14. —
A substation automation system risks
May 14, 2018 Slide 14
Layered architecture
Enterprise NetworkNetwork Control CenterMaintenance Center
Service PC
www.
Secure
SW/FW
Multi – technology
based
operational utility
core network
Core network element
PDH,, SDH Optical,
MPLS, L2 optical / el.
Radio; Wi-Fi, PLC
Any Substation,
Control-Center;
Power-Plant
down to private
consumer
DMZ
Individual User Accounts
Removable Media
Access
Disable Ports /
services
Malware Protection
Patch management
Firewall
Secure
Communication
Local security logging
Central security
logging /Account
Management
IDS
USB
SDM
600
Redundant &
reliable clock &
time
distribution
(not only GPS)
Remote
Support

15. —
Cyber security for digital substations
IEC 61850-9-2LE: Actions taken for process bus hardening

16. —
Protocols alloacation over Ethernet: IEC 61850-8-1 and 9-2 togheter
IEC 61850-9-2LE: Actions taken for process bus hardening
May 14, 2018 Sources: ABBSlide 16
The station and process bus togheter offers the following
services. using the 7 OSI layers:
Vertical communication over MMS: Data exchange among
IEDs and supervisory system;
Horizontal communication with GSE messages: Information
between the IEDs;
Process communication: GSE for binary signals between the
IEDs and the merging units, SMV messages for analogs such
as currents and voltages;
IEEE 1588 (PTP) for devices synchronism, accuracy around 1
µs;
Network redundancy in IEC 62439-3 standard (PRP and HSR).
Protocols and services
1
2
3
GOOSE
SV,
GOOSE
Bay 1
Process
bus
Station bus
Merging
Unit
Prot &
Ctrl
Devices
Station
Computer
Gateway
Bay n
SAM600SAM600
4

17. —
The sampled values in process bus
IEC 61850-9-2LE: Actions taken for process bus hardening
May 14, 2018 Sources: ABBSlide 17
Which signals are transmitted in a SMV frame?
Four currents, four voltages and their quality information.
Merging units and SMV according IEC 61850-
9-2LE
1
984 bits
This is the size of a
typical SMV frame
4800
It´s the number
of samples in one
second in a 60Hz
frequency rate
5Mb/s
It´s the Ethernet
network
bandwidth
allocated for a
single SMV frame
SMV frame captured with the IEC
61850 State of art testing tool
ITT600

18. —
Application of HSR protocol for the switchyard network
IEC 61850-9-2LE: Actions taken for process bus hardening
May 14, 2018 Sources: ABBSlide 18
No switches required, no access point, no point of failures

19. —
Cyber security for digital substations
Protection and control cyber security features

20. —
Protection and control cyber security features
May 14, 2018 Slide 20
Protocol hardening Account management Security event logging
Role based account control Certificates Supervision and configuration
- Fuzz testing all protocols
- Security development life cycle
- Protocol conformance
- Device security testing
- Extensive service and port configuration
- Flooding protection
- Local users created in the device
- PCM600 used to manage users
- Removal of default users and passwords
- Central account management –
IEC 62351 with LDAP
- Audit trail
- Reporting on IEC 61850
- Syslog
- Offline log in every IED
- User roles
- User rights
- IEC 62351 part 8
- Self signed certificates
- Customer signed certificates
- Encryption of communication
- Self supervision of hardware and software
- Denial of Service protection
- Extensive configuration possibilities
- Maintenance menu
Features overview

21. —
Reduce your attack surface Robustness
Only use required services
- All protocol in the IED is checked for protocol conformance
- Fuzz testing is used to make sure we withstand against
possible attack points
- All developers follow ABB’s security development life cycle
process
May 14, 2018 Slide 21
- To reduce the attack surface of the IED we have added
possibility to enable/disable protocols and services per
physical interface
- Configure only the services you need
Protection and control cyber security features
Protocol hardening

22. —
Troubleshooting
Protection and control cyber security features
May 14, 2018 Slide 22
To help the user with common configuration mistakes and to
give solutions to common problems, the IED now have a Hints
menu
– Typical hints can be
• Incorrect configuration of time synchronization
• Invalid reference channel detected
• IEC/UCA 61850-9-2LE data is substituted
Before doing a major change of your configuration, save a restore
point of your IEDs state. This possibility is now added to the
Maintenance menu of the IED.
- Store up to two restore points
With hints and undo possibilities

23. —
Encryption card
FOX615 and XMC20 Multiplexers
May 14, 2018 Slide 23

24. —
Cyber security for digital substations
Cyber security deployment guidelines

25. —
Cyber security deployment guidelines
Where to find how to configure security?
In the cyber security deployment guideline there are available info
on how to configure the security for the Relion® 670 and 650
series IEDs
It covers
- System setup
- Account management (local / centralized)
- Activity logging
- Local HMI usage (incl. Maintenance menu)
- Standard compliance statement
Instructions for hardening