Next Generation Electrical Substation Cyber Resilience

Problem Statement

The current landscape of cybersecurity in the Energy Sector is fraught with challenges. Critical infrastructures are increasingly targeted by sophisticated cyber threats. The existing systems for managing and responding to these threats often lack interactivity and the ability to provide intuitive, real-time feedback and in-depth operational insight. These deficiencies lead to delayed responses and a lack of comprehensive situational awareness, resulting in substantial operational disruptions and safety hazards.

During a crisis such as a cyber security incident on a critical infrastructure, having immediate situational awareness is key. It is essential that security data is available and presented in an easy-to-understand format. The incident response coordinator needs to build a timeline of events and be able to onboard any 3rd party that can provide expertise to contain the incident and bring it to a safe resolution.

This project aimed to implement a cyber resilience solution that provides enhanced visibility, timely threat detection, and accelerated response across all substations. The goal is to minimize cyber disruptions, reduce downtime, and protect power transmission operations against malicious activities.

Specifically, this project delivered the following cybersecurity capabilities:

  • Centralized visibility of security telemetry and monitoring security data across all substation environments.
  • Asset inventory and network mapping to gain a holistic view of the substation’s attack surface.
  • Tailored alerting tuned to detect OT cyber security events and operational impacts.
  • Tighten collaboration between security and engineering teams for rapid threat investigation and response.
  • Secure backup and rapid restoration of device configurations to minimize downtime.

 

The desired outcome is an integrated defence-in-depth approach that hardens substation environments against constantly evolving cyber threats. This project provided an implementation plan to deliver a cyber resilience solution that enhances substation security and protects operations.

 

This approach is aligned with best-in-class cyber security practices: 

  • Reduce the Attack Surface 
  • Harden network infrastructure
  • Provide real-time risk posture view of the electrical substations
  • Increase visibility into operational path of cybersecurity events
  • Facilitate incident response to reduce downtime and speed up recovery
  • Ensure Substation integration into a Cyber Security Operations Centre

Architectural diagram upgrades

Each workstation/server is OT endpoint secured through:

SentryOT agents with XDR capabilities which allows tracking commands from application to physical devices. XDR capabilities empower security teams to contain the threat and act towards secure resolution.

The local process and control network was updated with:

SentryOT Collectors receive, process and correlate industrial process communication and security telemetry from all devices to provide meaningful alerts. It provides:

  • records and forwards entire network traffic to the SentryOT Engine
  • deep packet inspection of Industrial control protocols
  • aggregator for Win/Linux agents deployed on servers and workstations to collect OS and Control Application logs
  • collects syslog from network and industrial devices
  • active polling of configuration and operational details from industrial control devices using industrial protocols and SNMP

SOC

We proposed a comprehensive Security Operations Centre covering all relevant aspects of Cyber Security for Energy Sector based on:

SentryOT – enables Comprehensive Visibility in the OT network by ensuring early threat detection, vulnerability management and blind spots optimization, asset backup and recovery, while building an up-to-date asset inventory and an accurate topology of your OT network. SentryOT presents the below core functionality pillars:

  • Operational Visibility – advanced correlation of network, security and operational data to enable early threat detection. Through its deep protocol inspection, SentryOT provides understanding operational path and physical impact of the cyber threat for safe incident resolution.
  • Asset Inventory – a full asset inventory containing hardware, firmware, operating system and application versions for all devices, enabling vulnerability management.
  • Configuration Backup – keeps configuration backups for applications and IEDs stored on a safe partition for effective recovery.
  • Network Topology – performs operational process aware correlations to enable a comprehensive understanding of the network architecture, enabling identification of architectural vulnerabilities
  • SIEM – entire security telemetry is collected from the OT network and stored securely by the built-in SIEM. This allows security analysts to effectively search for Indicators of Compromise (IoC) and their spread within the OT network to conduct forensics.

Substation Activities and Professional Services

Discover:

  • involves performing a brief technical assessment to understand the architectural layout of the infrastructure and identify all security relevant data sources (interviews and documentation review).

Prepare:

  • the network infrastructure will be tuned to mirror traffic and collect/forward security data.
  • agents will be deployed on to the SCADA system to enable, collect and forward security data.
  • a full configuration backup of all devices will be performed.

Deploy:

  • Install a security sensor at each Substation that ingest traffic and collects all security relevant data to integrate the substation into the Central Platform
  • configure tailored alerts for each substation
  • maintain an up-to-date network diagram.
  • securely store configuration backups

To ensure the highest quality of security monitoring and granular visibility, SentryOT automation engineering team enabled data sources on all devices and applications, updated the device configuration to allow syslog events delivery and install a lightweight client on the Windows machines to collect and deliver control application and OS security events. From a networking point of view, we enabled traffic mirroring and created a dedicated VLAN for the platform management and one for the collection of security events.

SentryOT’s associated professional services ensured tailored mapping of your operational process to provide meaningful alerts which are easy to understand by both security analysts and process operators.

Conclusion

Our core objective is to provide the next generation of industrial cyber resilience that enables comprehensive visibility into the operational process. This allows streamlining the process of threat detection and response and enhances the overall understanding of the substation’s operational dynamics.

Core Unique Benefits:

  • Comprehensive Visibility – advanced correlation of network, security and operational data to enable early threat detection.
  • Tailored Professional Services – mapping your operational process to generate meaningful alerts.
  • Deep OT insight – understanding operational path and physical impact of the cyber threat for safe incident resolution.