How Much Will The Implementation Of Security Measures Cost?

Almost everybody is talking about security measures in the context of automation and communication systems in factories, power plants, substations, hospitals, ... Talking about the topic is one thing - what's about implementing and sustainable use of secure systems? Hm, a good question.
A news report published on June 13, 2017, under the title
"The “Internet of Things” is way more vulnerable
than you think—and not just to hackers
points out that many - maybe most - devices that communicate using internet technologies are not capable to carry the load needed for reasonable security measures. One paragraph referring to Joe Weiss (a well known expert) is eye-catching:
"Weiss believes that the first step in securing the IoT is to build entirely new devices with faster processors and more memory. In essence, hundreds of billions of dollars’ worth of machines need to be replaced or upgraded significantly."

Click HERE to read the complete report.

I would like to see - at least - more powerful platforms when it comes to new installations. Be aware that the cost of a new platform with implemented state-of-the-art security measures is one thing. Another thing is to implement a more centralized security infrastructures to manage the security.
IEC 62351-9 specifies cryptographic key management, namely how to generate, distribute, revoke, and handle X.509 digital certificates and cryptographic keys to protect digital data and its communication.
Primary goals of the series IEC 62351 are considered for the use of cryptography:

• Verifying the claimed identity of a message sender (authentication);
• Verifying that the sender has the right to access the requested data (authorization);
• Ensuring no one has tampered with a message during transit (integrity);
• Obscuring the contents of a message from unintended recipients (confidentiality);
• Associating specific actions with the entity that performed them (non-repudiation).

It is recommended for vendors and users to pay more attention to IEC 62351 (and other standards) and to listen carefully to the experts involved in protecting our infrastructures.
A reasonable white paper on the matter has been published by the BDEW (Germany): "Requirements for Secure Control and Telecommunication Systems".
Click HERE to access the BDEW white paper.
Click HERE for further information (some documents are in English).
Click HERE for a paper discussing the BDEW white paper.

IEC TC 57 has Published Several New Documents

IEC TC 57 has published several new documents related to IEC 61850 and IEC 62351 (Security):

(57/1840/RVC)
IEC 61850-7-3: Amendment 1 - Communication networks and systems for power utility automation - Part 7-3: Basic communication structure - Common data classes
The amendment has been accepted with 100 % in favour

(57/1838/FDIS)
IEC 62351-9: Data and communications security –
Part 9: Cyber security key management for power system equipment
voting closes 2017-03-17

(57/1835/RVN)
Communication networks and systems for power utility automation - Part XXX: System management for IEC 61850 (proposed IEC 61850-XXX TS)
The new work item proposal has been accepted with 100 % in favour

(57/1834/RVN)
IEC 61850-7-7: Basic communication structure – Machine-processable format of IEC 61850-related data models for tools
The new work item proposal has been accepted with almost 100 % in favour

CDV of IEC 61850-6 Amendment 1 and IEC 62351-9 available for comments

IEC TC 57 has published the following documents for review:

57/1697/CDV
IEC 61850-6 A1: Amendment 1 to IEC 61850-6 Ed.2:Communication networks and systems for power utility automation -
Part 6: Configuration description language for communication in electrical substations related to IEDs

The Amendment incorporates 60 Tissues - listed in the CDV document. You can find easily what has been revised.

57/1699/CDV
IEC 62351-9: Power systems management and associated information exchange - Data and communications security -
Part 9: Cyber security key management for power system equipment

Please take some time to review both documents.
The documents should be available online for reading and for comments.
Check HERE for the access and for providing comments.

Cyber security key management for power system equipment

IEC TC 57 has just published a new committee draft:57/1388A/CD

IEC 62351-9:
Power systems management and associated information exchange – Data and communications security – Part 9: Cyber security key management for power system equipment

Closing date for comments is: 2013-11-15

Please contact your TC 57 national body to get a copy of the CD.

The present document cancels and replaces the previous document 57/1388/CD and differs merely by the project number IEC 62351-9 (previously IEC TS 62351-9); the document is intended to be issued as an IEC International Standard (IS) and no longer as an IEC Technical Specification (TS).

The normative clauses are:

7 General key management requirements
8 Asymmetric key management
9 Symmetric key management

I highly recommend to review that document to make sure to get a consistent set of requirements applicable for all IEDs in the whole energy market – not only in the electric power delivery system.