New Idea Proposal. Electrical Power System Cyber Device Function Numbers, Acronyms, and Designations 09/13/2017

Transcription

1 1 New Idea Proposal Electrical Cyber Device Function Numbers, Acronyms, and Designations 09/13/2017

2 Future 2 Currently PS cybersecurity is viewed primarily as an issue for the back office IT and compliance depts. IED configuration software is used to configure aspects of both relay P&C and cyber. Other than a firewall, a standard drawing package has no way of specifying cyber controls. A standard drawing package has no way of identifying what cyber services/features are enabled. Need Something similar to PC37.2 but with a focus on identifying/documenting what cyber related features are enabled and what protective cyber controls are set.

3 Future 3 Relay Design Engineer Design protective relaying functions based on operational requirements and equipment ratings Relay Operational Oneline Based on Relay Function Codes Relay Settings Engineer Programming of relaying and other devices based on relay design specification Cyber Design Engineer Design protective cyber functions based on operational requirements and capabilities of devices Based on Cyber Function Codes Cyber Settings Engineer Programming of relaying and other devices based on cyber design specification

4 Future 4 Relay Operational Oneline Common 21 - Distance Relay 27 Undervoltage Relay 32 Directional Relay 50 Instantaneous Relay 51 AC Time Overcurrent Relay 52 AC Circuit Breaker 59 Overvoltage Relay 64 Ground Detector Relay 87 Differential Protective Relay ANSI /IEEE Standard C37.2 Standard for Electrical Device Function Numbers, Acronyms, and Contact Designations c48 Firewall Type: Application Gateway c49 AAA Server c50 Role based access control c51 Report cyber events to master c52 Cyber-event concentrator (RTU) c53 Cyber-event converter, (e.g. DNP -> Syslog) (RTU) c54 Log cyber-events locally c56 - Antivirus c57 Enable host firewall c58 Intrusion detection c59 Intrusion prevention c60 Web access c61 Application whitelisting c62 alerts c63 Network DoS detection c64 Network encryption c65 HD encryption c66 HTTPS c67 SSH c68 Telent c69 Active port detection c70 NSM/IDS with Protocol DPI c90 CPU & RAM Differential over Δt w/o protection event c100 - Cyber lockout, revoke all remote control EXAMPLES IEEE Standard ***** for Electrical Cyber Device Function Numbers, Acronyms, and Designations

5 Future 5 c50 Role based access control c51 Report cyber events to master c52 Cyber-event concentrator (RTU) c53 Cyber-event converter, (DNP -> Syslog) c54 Log cyber-events locally c56 - Antivirus c57 Enable host firewall c58 Intrusion detection c59 Intrusion prevention c60 Web access c61 Application whitelisting c62 alerts c63 Network DoS detection c64 Network encryption c65 HD encryption c66 HTTPS c67 SSH c68 Telent c69 Active port detection c70 NSM/IDS with Protocol DPI c100 - Cyber lockout, revoke all remote control Potential Benefits Universally understood Procurement: can the device do c** - IEEE 1686 (Scoping, Designing, Commissioning) Multiple vendors, contractors, integrators Maintenance What devices require signature updates Identify failed cyber component Incident Response What devices saw the event What devices recorded the event What devices were impacted What device failed to alarm or take action Saves time and money Prevents extended operational downtime