Power Today – Ensuring Your Power Station’s Safety

In response to the urgent need for a future driven by zero carbon emissions, the global energy sector is embracing the digital revolution of the electricity network. This entails the complete digitization and interconnection of all data. However, where data exists, there is also a risk of potential breaches. In most nations, the flow of energy and information/data in power stations are kept separate. Present-day power stations primarily handle electricity transmission and distribution. However, it’s anticipated that both energy and data will be transmitted through power stations in the foreseeable future. This is why substation automation systems (SAS) will play a vital role in facilitating energy distribution. Hence, safeguarding the SAS from cyber threats is of utmost importance.

Ensuring the Security of the Digital Power Grid is a Matter of National Security

In today’s interconnected ecosystem, the power grid is linked to various digital networks. Substation automation stands as a prime example of the convergence of Operational Technology (OT) and Information Technology (IT). Supervisory Control and Data Acquisition (SCADA) systems and other applications automate repetitive tasks and lessen the need for continuous human intervention. Despite its advantages, digitizing the power grid also brings new risks in case of compromises due to cyber attacks.

In April 2022, two months following Russia’s invasion of Ukraine on various fronts, the Ukrainian government disclosed that its largest electricity provider thwarted a substantial cyber attack that could have caused a blackout affecting two million individuals. Cybersecurity specialists noted that hackers tried to unleash the Industroyer2 malware on high-voltage power substations in Ukraine, alongside deploying varied destructive malware like CaddyWiper. Hackers spread CaddyWiper, a type of erasing software, across Ukraine to wipe out data from compromised computer systems. The experiences of Ukraine serve as another warning for governments, regulatory bodies, and energy suppliers to act promptly to address the growing cyber threats. Ensuring the security of vital power infrastructure should always remain a top priority, whether during times of war or peace.

Cybersecurity Recommendations for Substation Automation

Hence, governmental bodies such as the North American Electric Reliability Corporation (NERC) and even the European Union (EU) are calling for enhanced cybersecurity regulations and guidelines for power grid utilities. For instance, in December 2022, NERC unveiled a new “Security Integration Strategy”, while the EU released its Network and Information Security Directive 2.0 (NIS 2.0).

Although fresh regulations are in the works for the sector, from a network security viewpoint, these regulations are centered on addressing the following three challenges in securing power grid automation systems:

1. Identifying Critical Assets

Power station automation systems encompass an array of configurable and manageable components such as protection relays, power meters, Human-Machine Interface (HMI), controllers, and network devices. These crucial assets from diverse suppliers lack a unified management platform, leading to poor asset identification. If any vulnerabilities exist, they are hard to spot and susceptible to exploitation by hackers, cybercriminals, or cyber terrorists. Hence, it is crucial to regularly update firmware or apply security patches during routine upkeep. Whenever possible, choose providers with a Product Security and Incident Response Team (PSIRT) to identify potential flaws and offer the latest security patches.

2. Enforcing Access Control

While physical access control remains robust, negligent implementation of logical access control policies or practices may expose the system to risks. Third-party vendors may adhere to security measures inconsistent with those of the system operator, or Operational Technology (OT) staff unfamiliar with Information Technology (IT) might erroneously configure or grant access to unauthorized users. Therefore, it is vital to collaborate with both internal and external operational teams to align with the maintenance guidelines and security configurations of the relevant system equipment and software.

3. Enhancing Security Measures

Firewalls can safeguard critical assets within a specified security perimeter, but external cyber attacks commonly exploit remote access, a prevalent vulnerability in contemporary digitalized power distribution systems. Implementing preemptive measures, which include routine monitoring of communication patterns and efficient identification of potential cyber threats, is essential for engineers to protect their power systems in the current threat environment. Consider employing a next-generation firewall (NGFW) equipped with an advanced intrusion protection system (IPS) and intrusion detection system (IDS) to detect suspicious and abnormal communications.

Conclusion

There’s no foolproof solution to completely eliminate cyber threats from your power station automation systems. However, comprehending the main challenges and practices can assist in reducing risks and enhancing the resilience of the entire power grid.

To explore how Moxa can assist in securing your power station automation system, download our white paper.