Cyber Security in Smart Grid Substations

This report describes the state of smart grid security in Europe, specifically the Netherlands, and the cyber security of substations in particular. The focus of this study is the perception of risks and threats in smart grid cyber security and the international standards implemented in smart grids. The created overview is based on semi-structured interviews with 13 experts originating from eight different European countries. These participants are employed at electricity producers, grid operators, technology consultants and technology providers in the utilities sector. Their expertise ranges from information security to electricity grids, specifically smart grid security. Some of them are members of smart grid security related standard committees. The key results of the state of practice are the following: 1. The interconnectivity of the smart grid with multiple stakeholders and European colleagues is indicated as the biggest threat to the security of the smart grid. 2. Another often mentioned threat is awareness. The experts generally indicate that awareness within top management is high. However, personnel on lower levels are reluctant to incorporate security in their processes. 3. All organizations are in a certain stage of implementing standards, the ISO27000 series most often. However, the experts indicate that they are waiting what standard is becoming the de facto before implementing it. From the interviews it can be concluded that the current state of cyber security is fragile. As the smart grid cyber security relies on an interconnected chain of organizations, it is as strong as its weakest link. Efforts are currently undertaken to prevent security threats and tackle risks, but these efforts are disparate; nearly none of the organizations in this research have fully implemented a relevant standard, a single is already certified. There is still a long way ahead before the European and specifically the Dutch smart grid is fully secured. See chapter 5 for a detailed overview. Besides these results, a Smart Grid Substation (SGS) Security Benchmark is presented in this report. This tool can be used to benchmark the level of cyber security of the smart grid within a utility organization. An organization can create a maturity profile by stating which of the 68 capabilities are implemented. Based on the results of the benchmark, the organization can identify areas of improvement and assist in creating a plan to improve its cyber security practices, thereby reaching a higher maturity level. The SGS Security Benchmark is based on capabilities described in international and North-American standards, and evaluated based on two rounds of semistructured interviews with the aforementioned experts. See chapter 6 for a detailed overview.