Salzburg Netz GmbH – Ein Unternehmen der Salzburg AG
SCADA Security
Balancing security and functionality in the development
and integration of next generation SCADA architectures
SG Tech Europe 2015
Overview
Short Introduction of Salzburg Netz GmbH
“Multi Utility” Operating Center
Supporting field teams
Controls Systems
Todays security aspects
New tasks and responsibilities in the smart grid
3 realized flag ship projects
Perspective
Smart Grids Operation
Salzburg AG
and
Salzburg Netz GmbH
Austria and the province of
Salzburg
City of Salzburg
Amsterdam
Business Fields &
Customers
Electricity
Natural Gas
District Heating
Water Supply
Cabel-TV
Telephony (VoIP)
Internet
428,000 Customer
installations / meters
36,100 Customers
15,540 Customers
20.100 Customers
152.000 Inhabitants
71,000 Customers
131,000 Customers
23,100 Customers
Public Transport
48 Mio. Passengers
Business Volume 2014: 1,284 Mio €
Employees 31.12.2014: 1,981
“Multi Utility”
Network Operating Center
Tasks and
Example: Flood June 2013
Alarm messages of one workplace
out of two
on June 2
nd
2013
06:30am till 07:30pm
300 alarm messages, one every 2
nd
and
½
minute in average
Example: Flood June 2013
Alarm messages of one workplace
out of two
on June 2
nd
2013
06:30am till 07:30pm
300 alarm messages, one every 2
nd
and
½
minute in average
200 telephone calls, one every 4
th
minute
Infrastructure for the
field teams
Remote READ-ONLY SCADA access
District heating, electrical grid protection as well as telecommunication
support teams
Mirror image of the SCADA system in the “IT-world“
SCADA System
Intranet
Remote control
WAN
Mirror image
DMZ
read only
“no command addresses”
weekly updates
and on demand
unidirectional
Remote Server
Virtual machine
Infrastructure for the
field teams
Remote READ-ONLY SCADA access
District heating, electrical grid protection as well as telecommunication
support teams
Mirror image of the SCADA system in the “IT-world“
SCADA System
Intranet
Remote control
WAN
Mirror image
DMZ
read only
“no command addresses”
weekly updates
and on demand
unidirectional
Remote Server
Virtual machine
Todays control system
security aspects
8 May, 2013
Electrical grid
out of control
Software malfunction
Hacking attack
Did they forget about
the software updates?
Are they fit for the
future?
Control systems of network operators
are connected
TSO and DSO
Control area: SO and Generators
Multi Utility: Branches
electricity and natural gas
Data exchange
Interconnection (substation)
First loop
State estimation data (e.g. voltage angle)
Austrian Awareness System
Information about the actual network state
For black start operation
The information exchange and interconnection is part of todys network
operation and will further increase
Todays control system security
aspects
“Communication layers” of
the control system
Standards
IEC 103 Substation level
IEC 104 Remote control WAN
IEC 101 Data exchange
SCADA
unencrypted communication
„plain text“
Remote maintenance
OM / OFF
no simple overview of active
connections
The communication of all layers is
unencrypted
What`s behind the other connected
control systems?
SCADA System Remote maintenance Control System of TSO Control System of DSO1, DSO2, … Substation Remote control WAN“Communication layers” of
the control system
Standards
IEC 103 Substation level
IEC 104 Remote control WAN
IEC 101 Data exchange
SCADA
unencrypted communication
„plain text“
Remote maintenance
OM / OFF
no simple overview of active
connections
The communication of all layers is
unencrypted
What´s behind the connected
control systems?
SCADA System Remote maintenance Control System of TSO Control System of DSO1, DSO2, … Substation Remote control WANActuators and sensors
New tasks in
the „Smart Grid“
Smart Grids Model Region Salzburg
http://www.smartgridssalzburg.at
Detailed Information
Objectives of the Model Region program
Gather a critical mass of Smart Grid applications:
analyse synergies, dependencies and interchange
Integrate challenges from different areas in
an integrated system solution
Realisation in network segments with
real-world challenges & customers
Implementation of Flagship
Projects, where many
applications and their
synergies become visible
In December 2009 Salzburg was awarded „1st Austrian Smart Grids
Model Region“ by the Austrian Climate and Energy Fund.
Smart Grids Model Region Salzburg
Pilot
Smart
Metering
ElectroDrive
Operator
model region
Smart Heat
Networks
Smart Web Grid
information model
for access to
smart grid data
BAVIS
DG-
DemoNet
Concept
Combined
heat
& power
V2G
Strategies
DG DemoNet
Smart Low
Voltage Grid
V2G
Interfaces
DG
DemoNet
Valid
Building2Grid
OPTRES
Consumer2Grid
ZUQDE
central
Voltage-/VAR
control
Smart
Infrastructure
Salzburg
DISPOWER
fuel cell
SGMS-HiT
buildings as
interactive
components
ISOLVES
PASSA-M
ICT
Smart
Synergie
SGMS-HiT
Accom- panying researchfinished and current projects
Vision
Stepwise, logic architecture
of the Smart Grids Model Region Salzburg
emerging to „Smart Infrastructure“
... Active distributed networks
... Virtual power stations
... Demand Side Mgmt
... E-Mobility
... New technologies
... follow-up project
... main inputs
Smart Model
Community
Köstendorf
Flag Ship Projects
Centralized MV Volt/Var Control
- ZUQDE
Distributed renewable Sources connection
- Smart LV
Grid Köstendorf
Centralized MV
Volt/Var Control
Voltage control by Load Drop
Compensation (LDC)
LDC capabilities are limited and the
coordinated
control of
all
Centralized MV
Volt/Var Control
Integration of decentralised
small hydro power plants into
the control system
Extension of the existing
remote control WAN and the
control system
How to secure the
generators access points
to the remote control
WAN?
Results: Maintaining the
voltage limits
Standard Operation
Operation with volt/var control
Flag Ship Projects
MV Centralized Volt/Var Control
- ZUQDE
Distributed renewable Sources connection
- Smart LV
Grid Köstendorf
In a dedicated test area the energy future is field-tested: It shall be
demonstrated that despite
50% distributed generation (PV-systems)
and
50%
density of E-Cars
supply and demand can be balanced by an intelligent smart
grid solution without affecting supply quality for customers!
We demonstrate the energy system of tomorrow!
Smart Grids Model
Smart Grids Model
Community Köstendorf
36 e-cars
+ controllable
charging
stations
i-MieV: 0 – 8 – 12 – 16 AmpereMonitoring
Smart Meter
as„eyes in the grid“
44 PV-systems
(225 kWp) +
41 use a
controllable
solar inverter
active- and reactive- powercontroll
Smart Grids Model
Community Köstendorf
36 e-cars
+ controllable
charging
stations
i-MieV: 0 – 8 – 12 – 16 AmpereMonitoring
Smart Meter
as„eyes in the grid“
44 PV-systems
(225 kWp) +
41 use a
controllable
solar inverter
active- and reactive- powercontroll
Building Energy
Agent (BEA)
decentralised optimisationOLTC transformer
250 kVA, 5 tapsThe
Smart Low
Voltage Grid
Controller
keeps the
overview (using
smart meters
)
and conducts the
orchestra of
smart grid
components (
PV-inverters, e-car
charging
stations
)
ensuring a
harmonic
ensemble
(smooth
operation of the
low voltage grid).
Building-Energy-Agent
E-Car charging
app
S
mart
LV G
rid
C
ontroller
smart E-Car charging station
The customer side
“putting the customer in the driving seat”
solar power systems
& controllable inverters
Building-Energy-Agent
E-Car charging
app
S
mart
LV G
rid
C
ontroller
smart E-Car charging station
smart meters &
energy app
solar power systems
& controllable inverters
Custome
r
side:
In
ter
net
The customer side
Flag Ship Projects
MV Centralized Volt/Var Control
- ZUQDE
Distributed renewable Sources connection
- Smart LV
Grid Köstendorf
Flagship Project HiT
Energieverbrauchs-Info
Lieber Kunde, Sie haben im Monat xy 523 kWh verbraucht Lieber Kunde, Sie haben im Monat xy 523 kWh verbraucht
HiT-Housing Area
Demand Response
Home Automation
E-Mobility
Energy Feedback &
Customer Interaction
(130 flats)
Energy - Center
Micro-CHP
Heat Pump
District Heating
Thermal Storage
Photovoltaic
User Interaction
Home automation
Variable tariffs
Energy feedback
Flagship Project HiT
Tablet PC with
Smart Center App
in monitoring flats
Price - Forecast
and consumption by color
Further functionalities
Home
automation application
Energy
cockpit
E-car sharing
booking system
Use of innovative
interaction technologies
Connections between customer applications and the control system
Smart Grids Operation and
control system security
Perspective or reality?
(Future) challenges
Integration
… low voltage grid
… Smart Grids applications
„Intelligent“ control tasks
more than ON and OFF
… decentralized generation
… flexible loads (DSR, DSM)
Increase of system flexibility
Generation of data – transmission of data – data mining
General framework
Preservation of system security
Guarantee of reliability and security of supply
Further tasks
Education of system operators
It´s not only about systems it´s about humans in the first step
Increase network knowledge and understanding of complex coherences, i.e.
relationships
Knowledge about networks physics and interaction of the different
components
„Training simulators“
Yesterday …
Network operation is the “beautiful world” of a closed system
without links to the world around …
Today …
… or are we ignoring todays security threats and
experiences of the ICT world?
Walter Schaffer, 2015.09.23
Brief Summary
Critical Infrastructure
Classic network operation concept for high- and medium voltag
Independent remote control and SCADA systems
New functionalities
„Intelligent“ solutions within SCADA
State Estimation, Network optimization, centralized voltage control
Smart Grids Applications
Expansion of network operation – active low voltage network operation
Challenges
Number of datasets
Connection to and data processing via intersection with other
systems
Second (virtual) system for
Smart Grids Operation
situated in the ICT
world
Smart Metering
Aggregation for data exchange with the classic network operation
Direct interconnection with Smart Grids Operation
42
Answers of the ICT world
Transaction security
Encryption (e.g. asymmetrical)
Authorization and authentication
Access right and password management
Quality (complexity) check
Validity and replacement ration
Automatized
Remote maintenance
TAN system (mTAN respectively smsTAN)
Down to the substation level
Remote access management tool
Up-to-date software
Patch Management
Walter Schaffer, 2015.09.23
NERC Standards
NERC … North American Electric Reliability
Corporation
„Reliability Standards for the Bulk Electric
Systems of North America“
CIP-007-3a Cyber Security – System
Security Management
R3. Security Patch Management
The Responsible Entity
(i.e. Transmission
and Generators)....
shall establish,
document and implement a security
patch management program for tracking,
evaluating, testing, and installing
applicable cyber security software
patches for all Cyber Assets within the
Electronic Security Perimeter(s).
http://www.nerc.com/
44
Sabotage Reporting
Cyber Security — Critical Cyber Asset Identification Cyber Security — Security Management Controls Cyber Security — Personnel & Training
Cyber Security — Electronic Security Perimeter(s)
Cyber Security — Physical Security of Critical Cyber Assets Cyber Security — Systems Security Management
Cyber Security — Incident Reporting and Response Planning Cyber Security — Recovery Plans for Critical Cyber Assets
Transmission Planning (TPL) Voltage and Reactive (VAR)
Interconnection Reliability Operations and Coordination (IRO) Modeling, Data, and Analysis (MOD )
Nuclear (NUC)
Personnel Performance, Training, and Qualifications (PER ) Transmission Operations (TOP)
Resource and Demand Balancing (BAL) Communications (COM )
Critical Infrastructure Protection (CIP)
Emergency Preparedness and Operations (EOP) Facilities Design, Connections, and Maintenance (FAC ) Interchange Scheduling and Coordination (INT)
