Grid Automation Products. SAM600 Process Bus I/O System Cyber Security Deployment Guideline

Transcription

1 Grid Automation Products SAM600 Process Bus I/O System Cyber Security Deployment Guideline

2

4 Copyright This document and parts thereof must not be reproduced or copied without written permission from ABB, and the contents thereof must not be imparted to a third party, nor used for any unauthorized purpose. The software and hardware described in this document is furnished under a license and may be used or disclosed only in accordance with the terms of such license. Trademarks ABB is a registered trademark of the ABB Group. All other brand or product names mentioned in this document may be trademarks or registered trademarks of their respective holders. Open Source License Acknowledgements This product incorporates open source software components covered by the terms of third party copyright notices and license agreements. For more information, refer to 1MRK BEN SAM600 Product Guide. Warranty Please inquire about the terms of warranty from your nearest ABB representative.

5 Disclaimer The data, examples and diagrams in this manual are included solely for the concept or product description and are not to be deemed as a statement of guaranteed properties. All persons responsible for applying the equipment addressed in this manual must satisfy themselves that each intended application is suitable and acceptable, including that any applicable safety or other operational requirements are complied with. In particular, any risks in applications where a system failure and /or product failure would create a risk for harm to property or persons (including but not limited to personal injuries or death) shall be the sole responsibility of the person or entity applying the equipment, and those so responsible are hereby requested to ensure that all measures are taken to exclude or mitigate such risks. This product is designed to be connected to and to communicate information and data via a network interface. It is Customer s sole responsibility to provide and continuously ensure a secure connection between the product and Customer s network or any other network (as the case may be). Customer s shall establish and maintain any appropriate measures (such as but not limited to the installation of firewalls, application of authentication measures, encryption of data, installation of anti-virus programs, etc) to protect the product, the network, its system and the interface against any kind of security breaches, unauthorized access, interference, intrusion, leakage and/or theft of data or information. ABB and its affiliates are not liable for damages and/or losses related to such security breaches, any unauthorized access, interference, intrusion, leakage and/or theft of data or information. This document has been carefully checked by ABB but deviations cannot be completely ruled out. In case any errors are detected, the reader is kindly requested to notify the manufacturer. Other than under explicit contractual commitments, in no event shall ABB be responsible or liable for any loss or damage resulting from the use of this manual or the application of the equipment.

6 Conformity This product complies with the directive of the Council of the European Communities on the approximation of the laws of the Member States relating to electromagnetic compatibility (EMC directive 2014/30/EU) and concerning electrical equipment for use within specified voltage limits (Low-voltage directive 2014/35/EU). This conformity is the result of tests conducted by ABB in accordance with the product standard EN for the EMC directive, and with the product standard EN for the low voltage directive. The product is designed in accordance with the international standards of the IEC series.

7 Safety Information Observe the following safety instructions when using the product. Before first usage, read the product documentation in order to ensure safe and reliable operation of SAM600 products. Dangerous voltages can occur on the connectors, even though auxiliary voltages are disconnected. Each SAM600 product must be safely connected to ground using the ground strap. Only a competent electrician is allowed to carry out the electrical installation. Always follow national and local electrical safety regulations. Non-observance of the safety information can result in death, personal injury or substantial property damage. Whenever changes in parameter settings are applied to SAM600 modules, take measures to avoid inadvertent tripping or malfunction of connected protection and control devices.

8

9 Table of contents Table of contents Section 1 Introduction This manual Intended audience Related documents Symbols and conventions Symbols Document conventions... 4 Section 2 Secure access Secure system setup Ethernet ports... 5 Section 3 User account management... 7 Section 4 Security event logging... 9 Appendix A Glossary SAM600 Process Bus I/O System 1 Cyber Security Deployment Guideline

10 2

11 1MRK UEN - Section 1 Introduction Section 1 Introduction 1.1 This manual The cyber security deployment guideline describes the process for handling cyber security when communicating with SAM600 modules. The guideline can be used as a technical reference during the engineering phase, installation and commissioning phase, and during normal service of the product. 1.2 Intended audience This guideline is intended for system engineering, commissioning, operation and maintenance personnel handling cyber security during the engineering, installation and commissioning phases, and during normal service. The personnel is expected to have general knowledge about topics related to cyber security. 1.3 Related documents SAM600 Product documentation SAM600 Product Guide SAM600 Engineering Manual SAM600 Operation Manual SAM600 Cyber Security Deployment Guideline SAM600 Accessory List SAM600-TS Wiring Diagram SAM600-VT Wiring Diagram SAM600-CT Wiring Diagram Document number 1MRK BEN 1MRK UEN 1MRK UEN 1MRK UEN 1MRK BEN 1KHL KHL KHL SAM600 Process Bus I/O System 3 Cyber Security Deployment Guideline

12 Section 1 1MRK UEN - Introduction 1.4 Symbols and conventions Symbols The electrical warning icon indicates the presence of a hazard which could result in electrical shock. The warning icon indicates the presence of a hazard which could result in personal injury. The caution icon indicates important information or warning related to the concept discussed in the text. It might indicate the presence of a hazard which could result in corruption of software or damage to equipment or property. The information icon alerts the reader of important facts and conditions. The tip icon indicates advice on, for example, how to design your project or how to use a certain function. Although warning hazards are related to personal injury, it is necessary to understand that under certain operational conditions the operation of damaged equipment may result in degraded process performance leading to personal injury or death. Therefore, it is recommended to comply fully with all warning and caution notices Document conventions A particular convention may not be used in this manual. Abbreviations and acronyms in this manual are spelled out in the glossary. The glossary also contains definitions of important terms. HMI menu paths are presented in bold. For example, select Main menu/settings. Parameter names are shown in italics. For example, the function can be enabled and disabled with the Operation setting. 4 SAM600 Process Bus I/O System Cyber Security Deployment Guideline

13 IEC MRK UEN - Section 2 Secure access Section 2 Secure access 2.1 Secure system setup Access to a SAM600 system is only possible through PCM600 and a physical connection to any SAM600 module in a SAM600 system through USB as illustrated in Figure 1. Once a SAM600 system is configured, each Ethernet port of the system supports only the functionality that is configured. The following communication services are configurable per port: Closed port (both Tx and Rx) IEC uplink (Tx enabled, Rx disabled) IEC downlink (Tx disabled, Rx enabled) IEC uplink and downlink (both Tx and Rx enabled) IEC (IEEE 1588 V2, both Tx and Rx enabled) IEC Station Bus IED Ctrl IED Prot IEC uplink ports SAM600 -TS SAM600 -CT SAM600 -VT USB IEC downlink ports PCM600 Sensor Figure 1: SAM600 secure system overview 2.2 Ethernet ports SAM600 modules only use Ethernet based protocols. Those protocols are IEC and IEC (IEEE 1588 V2). No TCP/IP or UDP ports are used and opened by a configured SAM600 system. SAM600 Process Bus I/O System 5 Cyber Security Deployment Guideline

14 6

15 1MRK UEN - Section 3 User account management Section 3 User account management A SAM600 system does not provide any local or central user account management services. SAM600 Process Bus I/O System 7 Cyber Security Deployment Guideline

16 8

17 1MRK UEN - Section 4 Security event logging Section 4 Security event logging A SAM600 system provides general event logging functionality that includes security relevant events as documented in Table 1. A SAM600 system does not provide any user activity logging as it does not support user management and authorization. Table 1: Security event types Severity Event name Description Required action Error Error Information Event buffer overflow Serial communication failure Configuration mode Created when the internal event queue overflows and log events are lost Created when a SAM600 module fails to receive a command from PCM600 on its USB port, or when a SAM600 module fails to send a command to PCM600 from its USB port Created when a SAM600 module is set to wait in configuration state Information Event log reset Created when the event log on a SAM600 module is deleted Information Information Information Information Information Information New application configuration applied New configuration applied New configuration received New system time set Port settings modified Reset to factory defaults Created when SAM600 parameter settings are modified as part of a configuration download Created when a SAM600 module has successfully applied a configuration Created when a SAM600 module has received a configuration Created when a new system time is set on the SAM600-TS module Created when a SAM600 system bus port settings are modified Created when the configuration of a SAM600 module is erased Information Simulation mode Created when the simulation mode is switched ON or OFF None Check the SAM600 module s USB connection. If the error persists, contact ABB support line. None None None None None None None None None For more information about event logging functionality, event types, and event names, refer to 1MRK UEN SAM600 Operation Manual. SAM600 Process Bus I/O System 9 Cyber Security Deployment Guideline

18 10

19 1MRK UEN - Appendix A Glossary Appendix A Glossary Abbreviation 1PPS AC AIS BMC DC FOCS FTDI GIS ICT IEC IED IID LE LED MAC MSVCB PCM600 PTP RCB SAM600 SAMU SCD SCL SCT SFP SMVID Description One Pulse Per Second Alternating Current Air Isolated Switchgear Best Master Clock Direct Current Fiber Optic Current Sensor Future Technology Devices International Ltd. ( Gas Isolated Switchgear IED Configuration Tool Substation Automation Communication Standard Intelligent Electronic Device Instantiated IED Description IEC LE Light Edition Light Emitting Diode Media Access Control Multicast Sample Value Control Block Protection and Control IED Manager IEEE 1588 Precision Time Protocol Report Control Block SAM600 Standalone Merging Unit Standalone Merging Unit Substation Communication Description System Configuration Description Language System Configuration Tool Small Form-Factor Pluggable Sample Value Identifier SAM600 Process Bus I/O System 11 Cyber Security Deployment Guideline

20 Appendix A 1MRK UEN - Glossary Abbreviation SST SV USB UTC Description System Specification Tool Sample Value Universal Serial Bus Coordinated Universal Time 12 SAM600 Process Bus I/O System Cyber Security Deployment Guideline

21 13