How can cybersecurity be enhanced in existing substations minimizing impact on the automation and control system

Most of existing substations were commissioned in a time when the only communication link was a private telecontrol bus. Since then, DSO and utilities practices have evolved and require more connectivity to the substation. These new practices and the increasing threat of malware have raised cyber security awareness. Even though a protection and automation control system is becoming more and more an IT system, it has its specific constraints (high availability, highly distributed, weak connectivity and a long lifecycle) and must be treated accordingly. The authors have collected technical security practices from the IT world and selected those that can be applied to a commissioned substation and require no change to the substation automation core software. While implementation of these techniques will not lead to full compliance to cyber security standards (such as NERC CIP) or recommendations (such as NISTIR 7628), the substation “attack surface” will be greatly reduced for a low cost.