Stopping industrial hackers: Cyber security for IEDs
In coming weeks, I’d like to highlight a variety of issues of critical concern to consulting-specifying engineers, from control interfaces to interoperability issues to cyber security. In my first few blogs I’ll lay out some basic issues, then we’ll delve at depth into each topic.
By the way, these issues deserve thoughtful discussion, so while I’ll lay out my thoughts on how to assist readers in addressing these issues, please use the forum to engage me and your peers on real-world examples, implementation challenges, and gaps in my own logic.
For today, let’s examine cyber security issues as they pertain to intelligent electronic devices (IEDs). Why? Because recent reports indicate that, for instance, hacking industrial interval meters for profit is a serious threat and one that is likely to grow.
In one recent case, unscrupulous individuals approached industrial companies and offered to hack into their meters to make them run slow, reducing the company’s electric bill and cheating the utility of its legitimate revenue. But the same skills could be used to make the industrial customer’s meter run fast, leading to unsustainable energy costs and a loss of competitiveness.
Right now, vendors typically specify the cyber security features of IEDs and they do so without necessarily providing a consistent basis for comparison on features. What constitutes a "password," what is the precise definition of a "user ID," how many levels should there be to such definitions? How vendors approach these questions varies.
The consulting-specifying engineer may be tackling an upgrade to an industrial substation for a large facility, so there may be capacitor bank controls, a remote terminal unit (RTU) that’s communicating with the utility, an RTU that’s communicating with the plant control system. Depending on the facility and how it’s interconnected with the utility, there will be various needs and requirements for cyber security. You’ll want to understand the weaknesses of every IED and design your cyber security plan to mitigate those weaknesses.
But how does one evaluate the apples and oranges world of vendor-specified IEDs?
We now have a tool to address this need. The IEEE Power and Energy Society’s Substations Committee, which I had the privilege to participate in, has developed a standard titled IEEE 1686, Standard for Substation Intelligent Electronic Devices (IED) Cyber Security Capabilities.
This standard was produced and balloted by many of the top minds in utility and industrial protection and control systems, and included participation from around the world. IEEE 1686 provides a method for the specification and evaluation of IEDs-for the specification of new IEDs that are going to be installed, and for the evaluation of existing IEDs that are already there.
So if a consulting-specifying engineer is working on a modification or an expansion to an industrial plant’s substation, and he or she sees a number of legacy IEDs and perhaps sees the need to add others, he or she can take IEEE 1686 and ask the vendor of the existing devices to fill out in the specification exactly what they do. There’s a table of compliance in the specification, and the consulting-specifying engineer can ask the vendor to fill it out to produce an immediate picture of exactly what is needed to upgrade the system.
Now, do legacy IEDs all need to be ripped out and replaced? Maybe, maybe not. IEEE 1686 will give the specifying engineer the ability to evaluate all of those existing IEDs and then determine which ones selectively need to be replaced due to cyber security shortfalls or which ones could stay in there and work within whatever design the cyber-security system is built on.
IEEE 1686 also provides a methodology that consulting-specifying engineers can use to evaluate new IEDs for their features and functions and ensure that they, too, will fit into the overall cyber security scheme.
For example, one of the aspects of IEEE1686 is that the vendor must provide a document that states, "There are no backdoors. There are no master passwords to this IED." Without impugning the integrity of any vendors, criminal hackers sometimes turn out to be insiders with intimate knowledge of product software vulnerabilities. So if the consulting-specifying engineer cannot get that statement from the vendor, then he or she needs to assume that there are people out there that know how to get into that IED. That is unacceptable because it means that the consulting-specifying engineer cannot then deliver their own work with confidence that it meets the highest cyber security standards.
If an IED controls circuit breakers and transformer taps-critical functions in that industrial facility-then you would have to be really concerned. If that IED is the revenue meter and somebody could actually go in and change how the revenue reads on that device, then there could be huge implications, financial implications, for all affected parties.
As a consulting-specifying engineer, when you turn over a system to an industrial customer and say, "Here’s your meter, here’s your monitoring system," you want that industrial customer to know that, in fact, this system is functioning correctly with the appropriate degree of cyber security required for the job.
Sam Sciacca is an active senior member in the IEEE and the International Electrotechnical Commission (IEC) in the area of utility automation. He has more than 25 years of experience in the domestic and international electrical utility industries. Sciacca serves as the chair of two IEEE working groups that focus on cyber security for electric utilities: the Substations Working Group C1 (P1686) and the Power System Relay Committee Working Group H13 (PC37.240). Sciacca also is president of SCS Consulting.