A new key draft document on Security has been published by IEC:
IEC 62351-10 TR Ed.1:
Power systems management and associated information exchange –
Data and communications security – Part 10: Security architecture guidelines
Ballot closes on 2012-06-22; ask your IEC National Committee for a copy.
Cyber security becomes more and more a basic requirement in power control systems as standard IT and other forms of modern communication technology are being increasingly used for control and supervision of these systems. The application of IT communication technology requires the consideration of already existing vulnerabilities, which can be exploited by potential attackers, as
recent intentional and unintentional cyber incidents on SCADA and other industrial control systems have shown. The increasing number of control system cyber incidents world-wide with medium to high impact underlines the requirement for appropriate security measures.
The draft document targets the description of security architecture guidelines for power systems based on essential security controls, i.e., on security-related components and functions and their interaction.
Furthermore, the relation and mapping of these security controls to the general system architecture of power systems is provided as guideline to support system integrators to securely deploy power generation, transmission, and distribution systems applying available standards.
The main clause is:
4. MAPPING SECURITY CONTROLS TO THE TC57 ARCHITECTURE
4.1 SECURITY DOMAINS WITHIN A GENERIC POWER SYSTEM ARCHITECTURE
4.2 APPLICATION OF SECURITY CONTROLS TO A GENERIC POWER SYSTE ARCHITECTURE
4.3 APPLICATION OF SECURITY CONTROLS TO SPECIFIC POWER SYSTEM SCENARIOS
4.3.1 Substation Automation
4.3.2 Control Center – Substation Communication
4.3.3 Advanced Metering
4.4 IDENTIFIED GAPS
See the list of all parts of the series IEC 61351:
It is HIGHLY recommended to ALL stakeholders in the energy industry to keep an close eye on the security issues!!
IEC 62351-10 TR Ed.1:
Power systems management and associated information exchange –
Data and communications security – Part 10: Security architecture guidelines
Ballot closes on 2012-06-22; ask your IEC National Committee for a copy.
Cyber security becomes more and more a basic requirement in power control systems as standard IT and other forms of modern communication technology are being increasingly used for control and supervision of these systems. The application of IT communication technology requires the consideration of already existing vulnerabilities, which can be exploited by potential attackers, as
recent intentional and unintentional cyber incidents on SCADA and other industrial control systems have shown. The increasing number of control system cyber incidents world-wide with medium to high impact underlines the requirement for appropriate security measures.
The draft document targets the description of security architecture guidelines for power systems based on essential security controls, i.e., on security-related components and functions and their interaction.
Furthermore, the relation and mapping of these security controls to the general system architecture of power systems is provided as guideline to support system integrators to securely deploy power generation, transmission, and distribution systems applying available standards.
The main clause is:
4. MAPPING SECURITY CONTROLS TO THE TC57 ARCHITECTURE
4.1 SECURITY DOMAINS WITHIN A GENERIC POWER SYSTEM ARCHITECTURE
4.2 APPLICATION OF SECURITY CONTROLS TO A GENERIC POWER SYSTE ARCHITECTURE
4.3 APPLICATION OF SECURITY CONTROLS TO SPECIFIC POWER SYSTEM SCENARIOS
4.3.1 Substation Automation
4.3.2 Control Center – Substation Communication
4.3.3 Advanced Metering
4.4 IDENTIFIED GAPS
See the list of all parts of the series IEC 61351:
It is HIGHLY recommended to ALL stakeholders in the energy industry to keep an close eye on the security issues!!
Posts
2 comments:
The key message of part 10 is about layered defense. Only a combination of bullet-proof network security and domain-specific security (e.g.: IEC 62351) means can protect installation in the context of a critical infrastructure sufficiently.
IEC 62351 Part 6 is specifically for IEC 61850.
Note it says in Chapter 1:
cl 1.2 "The initial audience for this specification is intended to be the members of the working groups developing or making use of the protocols .... they must be referenced by the specifications for the protocols themselves....
The subsequent audience for this specification is intended to be the developers of products that implement these protocols."
Cl4.1 says:
"For applications using GOOSE and IEC 61850-9-2 and requiring 4 ms response times, multicast configurations and low CPU overhead, encryption is not recommended"
So if the vendor's CPU and comms processing is not very good, they won't incorporate encryption facilities in the first place.
Best know what the real performance of your IEDs is and how you intend to use them, then specify to ensure you get what you need.
Post a Comment