7 ms·

There would be no way to do reporting on any of the devices in the field without some form of network connection. This delays response time if, for example, a r

There would be no way to do reporting on any of the devices in the field without some form of network connection. This delays response time if, for example, a recloser failed to operate, nobody would be aware unless someone physically checked the device. With networked SCADA systems, this becomes an immediate notification to the control room. I'm a fan of manual systems, but within reason though. The point is, you're never going to be 100% protected. People can still break into substations and compromise the grid rather easily.

toomuchtodo 7y ago
Read only monitoring is fine. “Write” ability must be heavily permissioned, audited, and governed. Failing that, no physical “write” access.
- mrob 7y ago
  Why are you reading something if you're not going to take action based on that data? Reads are de-facto writes elsewhere, so they need to be authenticated.
  - toomuchtodo 7y ago
    Action can be taken with analog, non networked controls.
    - closeparen 7y ago
      If reads or communications can be spoofed, operators can be convinced to take the wrong actions with their analogue controls.
      - deleted 7y ago
        [deleted]
      - toomuchtodo 7y ago
        Integrity of the monitoring apparatus isn’t out of scope, but simply too long of a discussion to be captured in this thread (vs “button that makes it break set to public”).
      - throw0101a 7y ago
        The "analogue control" may be some dude rolling up in a truck and doing the work. The "analogue control" is operated via radio or a ticketing dispatch system.
- rickycook 7y ago
  possibly, but what do you consider “write ability”? someone mentioned in another comment that if you control enough high power devices that report status to the grid (eg car chargers) so that the grid can take action (so read only but some other system uses it to take action) you can do plenty of damage they don’t really have write access, but they kinda do?
  - toomuchtodo 7y ago
    Write access, in my opinion, is where you have enough control to remotely override life critical or physical control systems that could cause death and/or significant physical damage to infrastructure and related failsafe systems can be bypassed or their thresholds exceeded intentionally. An Internet rando should not have the ability to disconnect your 700kva interconnect over the public internet. If you breach Tesla and can command enough vehicles to charge in a constrained area to overload local distributed infrastructure, failsafes should kick in and physically segregate loads from the local grid. Disclaimer: This is only my opinion as an infosec practitioner having done some infosec/GRC consulting for investor owed and coop utilities for FERC compliance.
- deleted 7y ago
  [deleted]
- jshowa3 7y ago
  Lets take my example and say you had a recloser that is stuck, but could be fixed by sending a command that would perform a manual close. Or maybe, you wanted to set the time threshold for the closing. a) Would you send a lineman out to the recloser and have them manually configure it, spending probably hours doing so? b) Or would you have some operator press a button in a piece of software to engage the recloser (thus, ultimately, writing whatever register in the device to perform the closing)? Now multiply that scenario to the potentially hundreds/thousands of reclosers in the field. Companies are going to choose b) every time.
  - toomuchtodo 7y ago
    Yes, I agree, which is why regulation is crucial to ensure a balance is struck between operational efficiency and security. If you want to interrogate recloser behavior remotely (real time and for historical logging), entirely reasonable. If you want to reclose manually or update trip and reclose thresholds, your commands or setting updates must be authenticated, logged, and cryptographically signed. If the ACR encounters lockout, you roll a truck (which you're probably going to do regardless, as lockout indicates a non-transient fault).
    - jshowa3 7y ago
      Alright, your response is a lot clearer now. However, this is how it currently is with NERC CIP, so I fail to see how having legislation that facilitates more manual devices really solves anything.

toomuchtodo 7y ago

Read only monitoring is fine. “Write” ability must be heavily permissioned, audited, and governed. Failing that, no physical “write” access.

mrob 7y ago
Why are you reading something if you're not going to take action based on that data? Reads are de-facto writes elsewhere, so they need to be authenticated.
- toomuchtodo 7y ago
  Action can be taken with analog, non networked controls.
  - closeparen 7y ago
    If reads or communications can be spoofed, operators can be convinced to take the wrong actions with their analogue controls.
    - deleted 7y ago
      [deleted]
    - toomuchtodo 7y ago
      Integrity of the monitoring apparatus isn’t out of scope, but simply too long of a discussion to be captured in this thread (vs “button that makes it break set to public”).
    - throw0101a 7y ago
      The "analogue control" may be some dude rolling up in a truck and doing the work. The "analogue control" is operated via radio or a ticketing dispatch system.
rickycook 7y ago
possibly, but what do you consider “write ability”? someone mentioned in another comment that if you control enough high power devices that report status to the grid (eg car chargers) so that the grid can take action (so read only but some other system uses it to take action) you can do plenty of damage they don’t really have write access, but they kinda do?
- toomuchtodo 7y ago
  Write access, in my opinion, is where you have enough control to remotely override life critical or physical control systems that could cause death and/or significant physical damage to infrastructure and related failsafe systems can be bypassed or their thresholds exceeded intentionally. An Internet rando should not have the ability to disconnect your 700kva interconnect over the public internet. If you breach Tesla and can command enough vehicles to charge in a constrained area to overload local distributed infrastructure, failsafes should kick in and physically segregate loads from the local grid. Disclaimer: This is only my opinion as an infosec practitioner having done some infosec/GRC consulting for investor owed and coop utilities for FERC compliance.
deleted 7y ago
[deleted]
jshowa3 7y ago
Lets take my example and say you had a recloser that is stuck, but could be fixed by sending a command that would perform a manual close. Or maybe, you wanted to set the time threshold for the closing. a) Would you send a lineman out to the recloser and have them manually configure it, spending probably hours doing so? b) Or would you have some operator press a button in a piece of software to engage the recloser (thus, ultimately, writing whatever register in the device to perform the closing)? Now multiply that scenario to the potentially hundreds/thousands of reclosers in the field. Companies are going to choose b) every time.
- toomuchtodo 7y ago
  Yes, I agree, which is why regulation is crucial to ensure a balance is struck between operational efficiency and security. If you want to interrogate recloser behavior remotely (real time and for historical logging), entirely reasonable. If you want to reclose manually or update trip and reclose thresholds, your commands or setting updates must be authenticated, logged, and cryptographically signed. If the ACR encounters lockout, you roll a truck (which you're probably going to do regardless, as lockout indicates a non-transient fault).
  - jshowa3 7y ago
    Alright, your response is a lot clearer now. However, this is how it currently is with NERC CIP, so I fail to see how having legislation that facilitates more manual devices really solves anything.