Stopping industrial hackers: Cyber security for IEDs

Let’s examine cyber security issues as they pertain to intelligent electronic devices (IEDs).

08/13/2012


In coming weeks, I'd like to highlight a variety of issues of critical concern to consulting-specifying engineers, from control interfaces to interoperability issues to cyber security. In my first few blogs I'll lay out some basic issues, then we'll delve at depth into each topic. 

By the way, these issues deserve thoughtful discussion, so while I'll lay out my thoughts on how to assist readers in addressing these issues, please use the forum to engage me and your peers on real-world examples, implementation challenges, and gaps in my own logic.

For today, let's examine cyber security issues as they pertain to intelligent electronic devices (IEDs). Why? Because recent reports indicate that, for instance, hacking industrial interval meters for profit is a serious threat and one that is likely to grow. 

In one recent case, unscrupulous individuals approached industrial companies and offered to hack into their meters to make them run slow, reducing the company's electric bill and cheating the utility of its legitimate revenue. But the same skills could be used to make the industrial customer's meter run fast, leading to unsustainable energy costs and a loss of competitiveness. 

Right now, vendors typically specify the cyber security features of IEDs and they do so without necessarily providing a consistent basis for comparison on features. What constitutes a "password," what is the precise definition of a "user ID," how many levels should there be to such definitions? How vendors approach these questions varies. 

The consulting-specifying engineer may be tackling an upgrade to an industrial substation for a large facility, so there may be capacitor bank controls, a remote terminal unit (RTU) that's communicating with the utility, an RTU that's communicating with the plant control system. Depending on the facility and how it's interconnected with the utility, there will be various needs and requirements for cyber security. You'll want to understand the weaknesses of every IED and design your cyber security plan to mitigate those weaknesses. 

But how does one evaluate the apples and oranges world of vendor-specified IEDs? 

We now have a tool to address this need. The IEEE Power and Energy Society's Substations Committee, which I had the privilege to participate in, has developed a standard titled IEEE 1686, Standard for Substation Intelligent Electronic Devices (IED) Cyber Security Capabilities

This standard was produced and balloted by many of the top minds in utility and industrial protection and control systems, and included participation from around the world. IEEE 1686 provides a method for the specification and evaluation of IEDs-for the specification of new IEDs that are going to be installed, and for the evaluation of existing IEDs that are already there. 

So if a consulting-specifying engineer is working on a modification or an expansion to an industrial plant's substation, and he or she sees a number of legacy IEDs and perhaps sees the need to add others, he or she can take IEEE 1686 and ask the vendor of the existing devices to fill out in the specification exactly what they do. There's a table of compliance in the specification, and the consulting-specifying engineer can ask the vendor to fill it out to produce an immediate picture of exactly what is needed to upgrade the system. 

Now, do legacy IEDs all need to be ripped out and replaced? Maybe, maybe not. IEEE 1686 will give the specifying engineer the ability to evaluate all of those existing IEDs and then determine which ones selectively need to be replaced due to cyber security shortfalls or which ones could stay in there and work within whatever design the cyber-security system is built on. 

IEEE 1686 also provides a methodology that consulting-specifying engineers can use to evaluate new IEDs for their features and functions and ensure that they, too, will fit into the overall cyber security scheme. 

For example, one of the aspects of IEEE1686 is that the vendor must provide a document that states, "There are no backdoors. There are no master passwords to this IED." Without impugning the integrity of any vendors, criminal hackers sometimes turn out to be insiders with intimate knowledge of product software vulnerabilities. So if the consulting-specifying engineer cannot get that statement from the vendor, then he or she needs to assume that there are people out there that know how to get into that IED. That is unacceptable because it means that the consulting-specifying engineer cannot then deliver their own work with confidence that it meets the highest cyber security standards. 

If an IED controls circuit breakers and transformer taps-critical functions in that industrial facility-then you would have to be really concerned. If that IED is the revenue meter and somebody could actually go in and change how the revenue reads on that device, then there could be huge implications, financial implications, for all affected parties. 

As a consulting-specifying engineer, when you turn over a system to an industrial customer and say, "Here's your meter, here's your monitoring system," you want that industrial customer to know that, in fact, this system is functioning correctly with the appropriate degree of cyber security required for the job.


Sam Sciacca, PE, senior member of IEEE, president of SCS Consulting LLC, Winsted, Conn.Sam Sciacca is an active senior member in the IEEE and the International Electrotechnical Commission (IEC) in the area of utility automation. He has more than 25 years of experience in the domestic and international electrical utility industries. Sciacca serves as the chair of two IEEE working groups that focus on cyber security for electric utilities: the Substations Working Group C1 (P1686) and the Power System Relay Committee Working Group H13 (PC37.240). Sciacca also is president of SCS Consulting.



No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
High-performance buildings; Building envelope and integration; Electrical, HVAC system integration; Smoke control systems; Using BAS for M&V
Pressure piping systems: Designing with ASME; Lab ventilation; Lighting controls; Reduce energy use with VFDs
Smoke control: Designing for proper ventilation; Smart Grid Standard 201P; Commissioning HVAC systems; Boilers and boiler systems
Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Consulting-Specifying Engineer case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.

Protecting standby generators for mission critical facilities; Selecting energy-efficient transformers; Integrating power monitoring systems; Mitigating harmonics in electrical systems
Commissioning electrical systems in mission critical facilities; Anticipating the Smart Grid; Mitigating arc flash hazards in medium-voltage switchgear; Comparing generator sizing software
Integrating BAS, electrical systems; Electrical system flexibility; Hospital electrical distribution; Electrical system grounding
Cannon Design’s blog is a place for the many voices of the firm to share thoughts and news related to current projects...
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.