The topic of cyber security is becoming increasingly important due to the constantly growing level of networking. Especially in the areas of energy and SmartGrid. Due to the threat situation, effective cyber security is essential there.
Cyber security is essential
Potential risks (data theft & data manipulation)
- Hacking & Cracking
- Listening
- Datamining
- Theft of passwords and other information
- Unauthorized access (intranet, end devices, servers, …)
- Modification of data & data telegrams
- Delete data
- Changing configurations
- etc.
Data flow in the context of the 7 network layer
The seven network layers
- Electrical interconnections must communicate with each other
- Integration into the World Wide Web (www)
- Integration of more measuring points
- Users on grid level 7 (local distribution grid <1kV) become (app) specialists (e.g. SmartHome, energy procurement, …)
- SmartGrid applications are becoming popular and also demanded
- Planning with simulation and trends are becoming increasingly important for the networks
- Dynamic load management (e.g. Redispatch, …)
The basic problem of cyber security
Risks in the energy infrastructure during cyber attacks
- Individual approaches take up only partial aspects of essential cyber security
- IT experts mostly have a technical focus and less on the overall context
- ISO/IEC27001 on cyber security provides a complete, holistic management system and is very complex
- IEC62443 on cyber security is in principle only applicable to the subarea of industrial automation
- There is still no IT security standard according to IEC for power quality instruments as well as power monitoring devices at device level. This is currently in the committees of EC TC 85 / WG 20 – Equipment for measuring and monitoring of steady state and dynamic quantities in Power Distribution Systems under the project title: “Cybersecurity aspects of devices used for power metering and monitoring, power quality monitoring, data collection and analysis “is discussed.
Potential solutions on cyber security
Cyber security is essential and here possible solutions are presented
In this blog, solution approaches are to be found at the level of measuring devices, which are also used in sub-areas of software solutions. From this, approaches from ISO/IEC27001 (Annex A; Reference measure objectives and measures) can be found, such as. For instance:
- Access control for systems and applications
- Cryptographic measures
- Physical and environmental security
- Protection from malware
- Data backup
- Logging and monitoring
The following approaches should make a significant contribution to a significant increase in safety at the level of measuring instruments:
- Assign role-based access rights (RBAC)
- Use transport encrypted websites (https)
- Client whitelist for limiting access to end devices
- Audit log for seamless monitoring of changes and operations
- SysLog to secure the operations (tracking)
- Apply certified firmware updates to measuring instruments and software
- Decentralised data loggers as redundancy outside the IT system
- Use secure connections in mobile applications
- Uninterruptible power supply (centralised/decentralised)
- Use metrologically certified measuring instruments
- Non-µP Measurement Devices
