ABB Relion REX610, Manual

Page: 15 / 36

Section 3 Secure system setup
3.1 Basic system hardening rules
Today's distribution automation systems are basically specialized IT systems.
Therefore, several rules of hardening an automation system apply to these systems,
too. Protection and control relays are from the automation system perspective on
the lowest level and closest to the actual primary process. It is important to apply
defense-in-depth information assurance concept where each layer in the system is
capable of protecting the automation system and therefore protection and control
relays are also part of this concept. The following should be taken into
consideration when planning the system protection.
• Recognizing and familiarizing all parts of the system and the system's
communication links
• Removing all unnecessary communication links in the system
• Rating the security level of remaining connections and improving with
applicable methods
• Hardening the system by removing or deactivating all unused processes,
communication ports and services
• Checking that the whole system has backups available from all applicable
parts
• Collecting and storing backups of the system components and keeping those
up-to-date
• Removing all unnecessary user accounts
• Defining password policies
• Changing default passwords and using strong passwords
• Checking that the link from substation to upper level system uses strong
encryption and authentication
• Segregating public network (untrusted) from automation networks (trusted)
• Segmenting traffic and networks
• Using firewalls and demilitarized zones
• Assessing the system periodically
• Using malware protection in workstations and keeping those up-to-date
It is important to utilize the defence-in-depth concept when designing automation
system security. It is not recommended to connect a device directly to the Internet
without adequate additional security components. The different layers and
interfaces in the system should use security controls. Robust security means,
besides product features, enabling and using the available features and also
enforcing their use by company policies. Adequate training is also needed for the
personnel accessing and using the system.
2NGA000818 A
Section 3
Secure system setup
REX610 9
Cyber Security Deployment Guideline