Data security for monitoring systems
This section discusses information on IT security in the context of power quality & power monitoring systems.
The chapter is dynamic and therefore not to be considered conclusive.
Conclusion
Unintentional data interventions mean that something is no longer the way it was planned in principle. Therefore, such interventions often have a direct impact on costs as well as on the reputation of the person or company concerned. The damage is therefore x times higher than just the defence or healing of the intervention that has taken place.
It should also be noted, that devices that have already been attacked can be used as a platform for the substantial spread of data tapping & manipulation. This means that unintentional access has an x-fold greater risk potential than it might initially appear.
The main characteristics of the 7 network levels in the context of data flow
- Electrical interconnections must communicate with each other
- Integration into the World Wide Web (www)
- Integration of more measuring points
- Users on grid level 7 (local distribution grid <1kV) become (app) specialists (e.g. SmartHome, energy procurement, …)
- SmartGrid applications are becoming popular and also demanded
- Planning with simulation and trends are becoming increasingly important for the networks
- Dynamic load management (e.g. redispatch, …)
- …
Conclusion
Data flows and volumes are increasing and are associated with extreme threats as well as obstacles (e.g. connectivity).
What data and manipulation security strategies are used?
- Definition of a company-specific IT(C) policy
- Employment of internal as well as external IT specialists in the respective areas of expertise
- Operate closed or isolated networks
- Strict compliance with country-specific data protection guidelines and laws
- Reduce proprietary systems (e.g. proprietary manufacturer interfaces)
- Use of standardized protocols (e.g. IEC 61850, PQDIF IEEE 1159.3, etc.)
- Use of additional software solutions for monitoring
- Centralisation of systems (hardware, software, personnel)
- Outsourcing of services to external companies
- Insourcing of outsourcing services
- Segmentierung des Netzes, um mögliche Attacken-Oberfläche zu minimieren
- …..
- …..
- Use of auditable security standards (e.g. ISO 27001, individual, etc.)
All points are not conclusive!
Insight into ISO 27001 – a workable approach?
This International Standard has been developed to specify requirements for the establishment, implementation, maintenance and continuous improvement of an Information Security Management System (ISMS).
The introduction of an information security management system is a strategic decision for an organisation. The creation and implementation of such a system within an organisation depends on its needs and goals, the security requirements, the organisational processes and the size and structure of the organisation. It can be assumed that all these influencing variables will change over time.
The information security management system maintains the confidentiality, integrity and availability of information using a risk management process and provides confidence to interested parties that risks are appropriately managed.
It is important that the information security management system is integrated into the organisation’s overall governance structure as part of its operations and that information security is already taken into account in the design of processes, information systems and measures.
It is expected that the implementation of a security system (ISMS) will be scaled according to the needs of the organisation.
This standard is supplemented by IEC62443. This in turn describes a holistic approach to cyber security. And this down to the component level within industrial automation.
The problem
A possible answer for monitoring applications
Conclusion
- If Cyber Security hardened components are not used, much more effort has to be invested in Cyber Security Manegement Systems. This is dangerous because insecure components cannot really be managed in a secure way either.
- Conformance testing of a product’s Cyber Security costs a minimum of the outlay for a security management system certificate
- Often, device manufacturers leave the costs for security management to the customers instead of developing secure products themselves