Please note the following information made public by US-Cert_CISA ... in case you use SIPROTEC 5 Relays:
EXECUTIVE SUMMARY
CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: SIPROTEC 5 relays
Vulnerabilities: Classic Buffer Overflow
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or trigger a remote code execution.
Siemens is the first company in the world to receive an IEC 61850 Edition 2 client certificate, issued by DNV GL on behalf of the UCA International User Group (UCA), for their SICAM PAS/PQS system (basically a PC application that acts as a 61850 client).
Click HERE for the news.
There are other vendors underway to get an IEC 61850 Edition 2 client certificate. TÜV SÜD (Munich) has also been accredited for testing conformance of Edition 2 clients.
More to come. Stay tuned.
The Siprotec 5 protection devices are the first devices of their kind on the market worldwide to be certified under IEC 61850, Edition 2. Thanks to the certification under IEC 61850, Edition 2, these Siemens products have the "future built right in," for long-term investment security.
All Siemens protection device series provide two new Ethernet redundancy protocols – HSR (high-availability seamless redundancy) and PRP (parallel redundancy protocol).
These new products prove that IEC 61850 is THE standard for energy delivery systems.
Click HERE for the press release.
More on Siprotec 5 could be found HERE.
The Siemens Siprotec solutions support usually several solutions for communication interfaces. The following list shows which communication solutions are supported by Siprotec 4 and Siprotec 5 devices:
According to Siemens comprises the installed base of Siprotec devices about one million devices and some 250,000 with IEC 61850. As you can see, the Siprotec 5 does (not yet) support IEC 60870-5-104*, not any more FMS, DP, and Profinet.
* under development for Siprotec 5.
Source (dated 2013):
Selection Guide for SIPROTEC Edition 2
The number devices with IEC 61850 interface is growing very fast. Recently experts from two German utilities told me that they expect that in some time down the road even 104 will not anymore be offered by major manufacturers.
http://www.energy.siemens.com/br/en/automation/power-transmission-distribution/protection/siprotec5/
Click on "Download Software & Documents" on right side of page.
The SIP 5.01 booklet is listed as "System Catalog V1.0"
There are may R&D projects underway to find appropriate ways how to secure millions of devices that need to communicate – all over.
A nice paper discusses this issues in the light of the question: what is a workable solution for a some hundred devices may not scale for millions of devices.
The report concludes: “The cryptographic infrastructure underlying the smart
grid the community envisions will likely require PKI, for scalability – but this is the beginning, not the end, of the solution.”
The good message we hear more often these days is: The path to smart(er) Hybrid Grids (power, gas, heat, …) will be long and steep. A challenge for a people involved – one way or the other.
Click HERE for the 3 page paper.
There is some progress in making power system automation more secure. Siemens writes in the SIPROTEC 5 - System Overview, Protection, Automation and Monitoring · Siemens SIP 5.01 · V1.0 (not yet available for download):
Click HERE for the DBEW Whitepaper “Requirements for Secure Control and Telecommunication Systems” [Dual Language: EN/DE]
Click HERE for further information in German (only).
Garderos (Munich, Germany) offers industrial-grade (ruggedized) routers which are self-managing and cyber-secure … secure against cyber-attacks … applicable for power grid applications.
Posts
All Comments
