![Thytronic XMR-A 4l+1A Manual Download Page 15](http://html1.mh-extra.com/html/thytronic/xmr-a-4l-1a/xmr-a-4l-1a_manual_1113984015.webp)
GENERAL
15
—
Cyber Security
Cybersecurity features implemented in XMR Relays help to mitigate cyber threats, realising:
• Secured communication between XMR protection relays and associated tool by
SSH
(
S
ecure
SH
ell) protocols
• Password based user authentication
•
R
ole
B
ased
A
ccess
C
ontrol (RBAC) authorization management
• Secured log storage (
Syslog
Service)
It is possible to identify the following operating areas:
• Configuration Management
• HW Systems and Networking Equipment
• Initial System Configuration
• Threat and Vulnerability Management
• Access Control
• Authentication and Authorization Management
• Auditing
• Network Communication Security
Described procedures have been selected considering the following standards and guide lines:
• ISO/IEC 27001:2013
•
NERC CIP
–
N
orth American
E
lectric
R
eliability
C
orporation
C
ritical
I
nfrastructure
P
rotection
• IEC 62351
IEC 62351 standard will be applied when specifically requested, covering the control of communtion
protocols and data flow.
Configuration Management
Configuration Management is a set of procedures whose purpose is to check hardware, firmware,
software and documentation changes in order to ensure that all devices are protected against
unwanted changes before, during and after the implementation of the system.
2.
HW Systems and Networking
EquipmentConfiguration
The devices are industrial and comply with the rules in terms of quality and electromagnetic
disturbances immunity. Regarding heat dissipation only passive systems without fans are used.
It is possible assign to devices IP addresses according to relevant network planning rules.
On request it is possible to implement adequate HW protection mechanisms (e.g. anti-tamper etc.).
Initial System Configuration
On protection relay are installed only and exclusively the network services necessary for protetion
application program execution, thus limiting the number of open TCP/UDP ports. All these services
and O.S. are updated to the latest version indicated at release time. Accesses for “well-known”
users are also removed and only a local non-administrator user is left active for the initial installtion
configuration of the device.
Threat and Vulnerability
Management
Device Operating System is supported by the relevant supplier ensuring compliance with security
bulletins issued regularly and related patches.
Authentication and Authorization
Management (AAM)
AAM is based on “RBAC” (Rule Based Access Control) model, i.e. the device will allow or not the
execution of certain functions according to assigned user role.
The following types of roles are available:
• “Administrator”: Equipment full control
• “Operator1”: First level limited Read/Write actions
• “Operator2”: Second level limited Read/Write actions
Auditing
The device keeps track, by “syslog” service, of the most important system operations/actions, such
as accesses, configuration changes and the like.
Network Communication Security
The device does not use unencrypted protocols such as telnet, ftp. All communications necessary
for equipment configuration eg: calibration, CID sending, etc. are routed via the “SSH” protocol, in
encrypted mode.
Data exchange protocols with the SCADA, e.g. IEC61850 / DNP3 / MODBUSTCP are unencrypted, if
IEC62351 specification is not expressly requested.
The synchronization protocols NTP, PTP are normally unencrypted.
XMR-D EQUIPMENT MANUAL
Ed. 2.9 - 02/2021