Operational considerations for substation security

Security of systems and information in the substation and the wider electrical grid infrastructure has been an area of greater focus in the recent times with the move from isolated systems to convergence of Information Technology (IT) and Operational Technology (OT) systems. The need for information availability, without compromising the integrity and confidentiality of data or of the assets, should lead to a stringent cybersecurity scoping within the substation automation systems. This paper investigates the practical implications of creating and managing cybersecurity solutions within modern substation protection and control IEDs and automation systems. This paper presents how to manage IED cyber security features, within a substation containing potentially several vendors' products. This covers topics such as password management systems for IED authentication, Role-Based Access Control (RBAC), authentication servers, security event logs, and firewalls. The paper also discusses the concepts of Defense in Depth used in Substation Automation environment and presents a use case of secure substation architecture. There is an ever-changing requirement of having domain experts dealing with security aspects, however, there also arises the need to have protection domain experts working hand in hand with cyber security experts to maintain a highly available but secure environment. This paper discusses how to bring technology, processes, and people together with security services such as security risk assessment, training, and patch management.