SCADA Security. Balancing security and functionality in the development and integration of next generation SCADA architectures

Transcription

1 SCADA Security Balancing security and functionality in the development and integration of next generation SCADA architectures SG Tech Europe 2015 Smart Grids Technical Forum Salzburg Netz GmbH Ein Unternehmen der Salzburg AG Walter Schaffer,

2 Overview Short Introduction of Salzburg Netz GmbH Multi Utility Operating Center Supporting field teams Controls Systems Todays security aspects New tasks and responsibilities in the smart grid 3 realized flag ship projects Perspective Smart Grids Operation ICT world Walter Schaffer,

3 Salzburg AG and Salzburg Netz GmbH Facts and Figures Walter Schaffer,

4 Austria and the province of Salzburg Amsterdam City of Salzburg Walter Schaffer,

5 Business Fields & Customers Public Transport 48 Mio. Passengers Internet 71,000 Customers Electricity 428,000 Customer installations / meters Natural Gas 36,100 Customers District Heating Cabel-TV 131,000 Customers Business Volume 2014: 1,284 Mio Employees : 1,981 Telephony (VoIP) 23,100 Customers 15,540 Customers Water Supply Customers Inhabitants Walter Schaffer,

6 Some impressions Walter Schaffer,

7 Multi Utility Network Operating Center Tasks and Responsibilities Walter Schaffer,

8 Example: Flood June 2013 Alarm messages of one workplace out of two on June 2 nd :30am till 07:30pm 300 alarm messages, one every 2 nd and½ minute in average 200 telephone calls, one every 4 th minute Walter Schaffer,

9 Example: Flood June 2013 Alarm messages of one workplace out of two on June 2 nd :30am till 07:30pm 300 alarm messages, one every 2 nd and½ minute in average 200 telephone calls, one every 4 th minute salzburg24.at Salzburger Nachrichten Walter Schaffer,

10 Infrastructure for the field teams Remote READ-ONLY SCADA access District heating, electrical grid protection as well as telecommunication support teams Mirror image of the SCADA system in the IT-world SCADA System Remote control WAN unidirectional Intranet Mirror image DMZ read only no command addresses weekly updates and on demand Remote Server Virtual machine Walter Schaffer,

11 Infrastructure for the field teams Remote READ-ONLY SCADA access District heating, electrical grid protection as well as telecommunication support teams Mirror image of the SCADA system in the IT-world SCADA System Remote control WAN unidirectional Intranet Mirror image DMZ read only no command addresses weekly updates and on demand Remote Server Virtual machine Walter Schaffer,

12 Todays control system security aspects Walter Schaffer,

13 8 May, 2013 Electrical grid out of control Software malfunction Hacking attack Did they forget about the software updates? Are they fit for the future? Walter Schaffer,

14 Todays control system security aspects Control systems of network operators are connected TSO and DSO Control area: SO and Generators Multi Utility: Branches electricity and natural gas Data exchange Interconnection (substation) First loop State estimation data (e.g. voltage angle) Austrian Awareness System Information about the actual network state For black start operation The information exchange and interconnection is part of todys network operation and will further increase Walter Schaffer,

15 Communication layers of the control system Standards IEC 103 Substation level IEC 104 Remote control WAN IEC 101 Data exchange SCADA unencrypted communication plain text Remote maintenance OM / OFF no simple overview of active connections The communication of all layers is unencrypted SCADA System Remote control WAN Substation Remote maintenance Control System of TSO Control System of DSO1, DSO2, What`s behind the other connected control systems? Actuators and sensors Walter Schaffer,

16 Communication layers of the control system Standards IEC 103 Substation level IEC 104 Remote control WAN IEC 101 Data exchange SCADA unencrypted communication plain text Remote maintenance OM / OFF no simple overview of active connections The communication of all layers is unencrypted What s behind the connected control systems? SCADA System Remote control WAN Substation Actuators and sensors Remote maintenance? Control System of TSO Control System of DSO1, DSO2, Walter Schaffer,

17 New tasks in the Smart Grid Smart Grids Model Region Salzburg Detailed Information Project reports Walter Schaffer,

18 Smart Grids Model Region Salzburg In December 2009 Salzburg was awarded 1st Austrian Smart Grids Model Region by the Austrian Climate and Energy Fund. Objectives of the Model Region program Gather a critical mass of Smart Grid applications: analyse synergies, dependencies and interchange Integrate challenges from different areas in an integrated system solution Realisation in network segments with real-world challenges & customers Implementation of Flagship Projects, where many applications and their synergies become visible source: Wolfgang Prüggler, TU Vienna Walter Schaffer,

19 Stepwise, logic architecture of the Smart Grids Model Region Salzburg emerging to Smart Infrastructure finished and current projects Vision DG- DemoNet Concept fuel cell DISPOWER Combined heat & power Pilot Smart Metering BAVIS OPTRES ISOLVES PASSA-M DG DemoNet Valid ZUQDE central Voltage-/VAR control Smart Heat Networks ElectroDrive Operator model region... follow-up project... main inputs Consumer2Grid V2G Interfaces V2G Strategies ICT Smart Synergie Building2Grid Smart Web Grid information model for access to smart grid data DG Smart DemoNet Model Smart Community Low Voltage Köstendorf Grid SGMS-HiT buildings as interactive components SGMS-HiT Accompanying research Smart Infrastructure Salzburg... Active distributed networks... New technologies... E-Mobility... Virtual power stations... Demand Side Mgmt Walter Schaffer,

20 Flag Ship Projects Centralized MV Volt/Var Control - ZUQDE Distributed renewable Sources connection - Smart LV Grid Köstendorf Buildings as interactive smart grid participants - Hit Walter Schaffer,

21 Centralized MV Volt/Var Control Walter Schaffer,

22 Voltage control by Load Drop Compensation (LDC) LDC capabilities are limited and the coordinated control of all volt/varrelated resources across the entire grid segment is necessary Walter Schaffer,

23 Centralized MV Volt/Var Control Integration of decentralised small hydro power plants into the control system Extension of the existing remote control WAN and the control system How to secure the generators access points to the remote control WAN? Walter Schaffer,

24 Results: Maintaining the voltage limits Standard Operation Operation with volt/var control Network reinforcement can be reduced and therefor investment costs saved! Walter Schaffer,

25 Flag Ship Projects MV Centralized Volt/Var Control - ZUQDE Distributed renewable Sources connection - Smart LV Grid Köstendorf Buildings as interactive smart grid participants - Hit Walter Schaffer,

26 Smart Grids Model Community Köstendorf In a dedicated test area the energy future is field-tested: It shall be demonstrated that despite 50% distributed generation (PV-systems) and 50% density of E-Cars supply and demand can be balanced by an intelligent smart grid solution without affecting supply quality for customers! We demonstrate the energy system of tomorrow! Walter Schaffer,

27 Smart Grids Model Community Köstendorf Monitoring Smart Meter as eyes in the grid 36 e-cars + controllable charging stations i-miev: Ampere 44 PV-systems (225 kwp) + 41 use a controllable solar inverter active- and reactivepowercontroll Walter Schaffer,

28 Smart Grids Model Community Köstendorf Monitoring Smart Meter as eyes in the grid 36 e-cars + controllable charging stations i-miev: Ampere 44 PV-systems (225 kwp) + 41 use a controllable solar inverter active- and reactivepowercontroll Building Energy Agent (BEA) decentralised optimisation OLTC transformer 250 kva, 5 taps The Smart Low Voltage Grid Controller keeps the overview (using smart meters) and conducts the orchestra of smart grid components (PVinverters, e-car charging stations) ensuring a harmonic ensemble (smooth operation of the low voltage grid). Walter Schaffer,

29 The customer side putting the customer in the driving seat E-Car charging app smart E-Car charging station Building-Energy-Agent Smart LV Grid Controller solar power systems & controllable inverters Walter Schaffer,

30 Customer side: Internet The customer side putting the customer in the driving seat E-Car charging app smart E-Car charging station Building-Energy-Agent Smart LV Grid Controller solar power systems & controllable inverters smart meters & energy app Walter Schaffer,

31 Flag Ship Projects MV Centralized Volt/Var Control - ZUQDE Distributed renewable Sources connection - Smart LV Grid Köstendorf Buildings as interactive smart grid participants - HiT Walter Schaffer,

32 Flagship Project HiT Energy Feedback & Customer Interaction (130 flats) E-Mobility Demand Response Energieverbrauchs-Info Lieber Kunde, Sie haben im Monat xy 523 kwh verbraucht Lieber Kunde, Sie haben im Monat xy 523 kwh verbraucht On-site distributed generation HiT-Housing Area Home Automation Walter Schaffer,

33 Flagship Project HiT SMART GRID SMART HOME Energy - Center Micro-CHP Heat Pump District Heating Thermal Storage Photovoltaic User Interaction Home automation Variable tariffs Energy feedback Walter Schaffer,

34 Use of innovative interaction technologies Tablet PC with Smart Center App in monitoring flats Price - Forecast and consumption by color Further functionalities Home automation application Energy cockpit E-car sharing booking system Connections between customer applications and the control system Security of the access points (open to the public) and the interface Walter Schaffer,

35 Smart Grids Operation and control system security Perspective or already reality? Walter Schaffer,

36 Perspective or reality? (Future) challenges Integration low voltage grid Smart Grids applications Intelligent control tasks more than ON and OFF decentralized generation flexible loads (DSR, DSM) Increase of system flexibility Generation of data transmission of data data mining General framework Preservation of system security Guarantee of reliability and security of supply Further tasks Education of system operators It s not only about systems it s about humans in the first step Increase network knowledge and understanding of complex coherences, i.e. relationships Knowledge about networks physics and interaction of the different components Training simulators Walter Schaffer,

37 Yesterday Network operation is the beautiful world of a closed system without links to the world around Walter Schaffer,

38 Today or are we ignoring todays security threats and experiences of the ICT world? Walter Schaffer,

39 Tomorrow

40 Possible future structure

41 Possible future structure

42 Brief Summary Critical Infrastructure Classic network operation concept for high- and medium voltag Independent remote control and SCADA systems New functionalities Intelligent solutions within SCADA State Estimation, Network optimization, centralized voltage control Smart Grids Applications Expansion of network operation active low voltage network operation Challenges Number of datasets Connection to and data processing via intersection with other systems Second (virtual) system for Smart Grids Operation situated in the ICT world Smart Metering Aggregation for data exchange with the classic network operation Direct interconnection with Smart Grids Operation Walter Schaffer,

43 Answers of the ICT world Transaction security Encryption (e.g. asymmetrical) Authorization and authentication Access right and password management Quality (complexity) check Validity and replacement ration Automatized Remote maintenance TAN system (mtan respectively smstan) Down to the substation level Remote access management tool Up-to-date software Patch Management Walter Schaffer,

44 NERC Standards NERC North American Electric Reliability Corporation Reliability Standards for the Bulk Electric Systems of North America CIP-007-3a Cyber Security System Security Management R3. Security Patch Management The Responsible Entity (i.e. Transmission and Generators)... shall establish, document and implement a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). Resource and Demand Balancing (BAL) Communications (COM ) Critical Infrastructure Protection (CIP) Sabotage Reporting Cyber Security Critical Cyber Asset Identification Cyber Security Security Management Controls Cyber Security Personnel & Training Cyber Security Electronic Security Perimeter(s) Cyber Security Physical Security of Critical Cyber Assets Cyber Security Systems Security Management Cyber Security Incident Reporting and Response Planning Cyber Security Recovery Plans for Critical Cyber Assets Emergency Preparedness and Operations (EOP) Facilities Design, Connections, and Maintenance (FAC ) Interchange Scheduling and Coordination (INT) Interconnection Reliability Operations and Coordination (IRO) Modeling, Data, and Analysis (MOD ) Nuclear (NUC) Personnel Performance, Training, and Qualifications (PER ) Transmission Operations (TOP) Transmission Planning (TPL) Voltage and Reactive (VAR) Walter Schaffer,

45 The question we have to answer is: What do we have to do today to fulfill our responsibilities and tasks of tomorrow to the satisfaction of your customers? Walter Schaffer,

46 Further Information Walter Schaffer Salzburg Netz GmbH Head of Electrical Grids Smart Grids Program Manager Tel. +43/662/ Walter Schaffer,