3 ms·

Wait a second, and think how real is the chance of protection relays having an Internet connection.

Rychard 6y ago
I would imagine the chance is higher than you think. Being able to remotely monitor and manage such systems may lead to big cost-savings, if it enables the same number of employees to monitor multiple locations. Seeing as how many tech companies routinely cut corners on security, one could easily imagine a non-tech company doing the same in an attempt to maximize profits.
- Animats 6y ago
  It's not just remote monitoring. Protective relaying involves some disconnects sending signals to distant disconnects to tell them not to disconnect. The idea is that when you have a sudden overload like a line down, you want to trip the breaker closest to the trouble, and not others elsewhere upstream. Without this, small disruptions take out too much of the grid. See NYC blackout of 1965.[1] This is why large transmission networks require some capability for fast transmission of data between circuit breakers. Not much data. But it's so much cheaper to send it over the Internet than to have separate microwave repeaters or separate cables or gear to send data over high-tension power lines. [1] https://en.wikipedia.org/wiki/Northeast_blackout_of_1965 https://en.wikipedia.org/wiki/Northeast_blackout_of_1965
netflixandkill 6y ago
Directly? Low. Indirectly through serial concentrators and RTUs and Scada access, almost 100%. The FERC / NERC security standards that fell out of this event are largely a bad joke, but had the benefit of at least requiring North American utilities to do something at all. Any transmission operator of size and most generation operations effectively require real time Scada for anything of meaningful capacity and they're sure not paying someone to sit next to it reading numbers off over a phone. They may not be IP addressed individually but to put it in perspective, I had a communication engineer tell me with a straight face that the fiber mux I telneted into over their local wifi wasn't internet connected, and thus the protection relays on the 500 kv substation the next building over were serial only -- over said fiber cables.
- vinay_ys 6y ago
  As an architectural building block we have been stuck with Firewalls, IDS etc. We need a new kind of isolation device – an air-gapped one-way data transmission gate – that can sit between critical safety control systems and their monitoring systems. These read-only monitoring systems can be connected to networks (presumably reachable to hackers through some means). As long as the safety control systems cannot be modified by any means, these types of failures should not happen. Also, irrespective of software safety, for a system like this grid power generator why can't they design physical safety relays/cutoffs? If the generator sped up beyond it's tolerances, it could cut-off. Why should it generate shocky torque that can damage the rubber grommets? That could be prevented by design?
  - Animats 6y ago
    "We need a new kind of isolation device – an air-gapped one-way data transmission gate – that can sit between critical safety control systems and their monitoring systems." Those are called "data diodes". They involve optical isolation. True one-way is very limiting, though. A bad idea: the "bidirectional data diode".[1] [1] https://www.fibersystem.com/wp-content/uploads/FS19189-Datasheet-Data-Diode-Bidirectional-1-Gbit-Tempest-R2.pdf https://www.fibersystem.com/wp-content/uploads/FS19189-Datas...
  - detaro 6y ago
    One-directional data transfer isn't really a problem: just have a wire that only sends data in one direction. If you want to be extra paranoid, make it an optical link. Or wireless transmit-only if that fits your application. Downside is you need more bandwidth since you can't have the receiver ask for a specific subset of data. The trouble always starts when someone wants remote inputs for some reason. Then you really need to start to think about a) how to protect the gateway systems and b) how to make sure that even if the gateway is cracked the damage is limited.
  - dreamcompiler 6y ago
    > why can't they design physical safety relays/cutoffs? They can and they do. Or at least "they" used to. Nowadays such safety devices are very often software enabled. Because it's cheap and also because it checks a box on the marketing brochure that every customer wants: "Software upgradability for lower maintenance cost and reduced down time." Oh the irony.

I would imagine the chance is higher than you think. Being able to remotely monitor and manage such systems may lead to big cost-savings, if it enables the same number of employees to monitor multiple locations. Seeing as how many tech companies routinely cut corners on security, one could easily imagine a non-tech company doing the same in an attempt to maximize profits.

Animats 6y ago
It's not just remote monitoring. Protective relaying involves some disconnects sending signals to distant disconnects to tell them not to disconnect. The idea is that when you have a sudden overload like a line down, you want to trip the breaker closest to the trouble, and not others elsewhere upstream. Without this, small disruptions take out too much of the grid. See NYC blackout of 1965.[1] This is why large transmission networks require some capability for fast transmission of data between circuit breakers. Not much data. But it's so much cheaper to send it over the Internet than to have separate microwave repeaters or separate cables or gear to send data over high-tension power lines. [1] https://en.wikipedia.org/wiki/Northeast_blackout_of_1965 https://en.wikipedia.org/wiki/Northeast_blackout_of_1965

netflixandkill 6y ago

Directly? Low. Indirectly through serial concentrators and RTUs and Scada access, almost 100%. The FERC / NERC security standards that fell out of this event are largely a bad joke, but had the benefit of at least requiring North American utilities to do something at all. Any transmission operator of size and most generation operations effectively require real time Scada for anything of meaningful capacity and they're sure not paying someone to sit next to it reading numbers off over a phone. They may not be IP addressed individually but to put it in perspective, I had a communication engineer tell me with a straight face that the fiber mux I telneted into over their local wifi wasn't internet connected, and thus the protection relays on the 500 kv substation the next building over were serial only -- over said fiber cables.

vinay_ys 6y ago
As an architectural building block we have been stuck with Firewalls, IDS etc. We need a new kind of isolation device – an air-gapped one-way data transmission gate – that can sit between critical safety control systems and their monitoring systems. These read-only monitoring systems can be connected to networks (presumably reachable to hackers through some means). As long as the safety control systems cannot be modified by any means, these types of failures should not happen. Also, irrespective of software safety, for a system like this grid power generator why can't they design physical safety relays/cutoffs? If the generator sped up beyond it's tolerances, it could cut-off. Why should it generate shocky torque that can damage the rubber grommets? That could be prevented by design?
- Animats 6y ago
  "We need a new kind of isolation device – an air-gapped one-way data transmission gate – that can sit between critical safety control systems and their monitoring systems." Those are called "data diodes". They involve optical isolation. True one-way is very limiting, though. A bad idea: the "bidirectional data diode".[1] [1] https://www.fibersystem.com/wp-content/uploads/FS19189-Datasheet-Data-Diode-Bidirectional-1-Gbit-Tempest-R2.pdf https://www.fibersystem.com/wp-content/uploads/FS19189-Datas...
- detaro 6y ago
  One-directional data transfer isn't really a problem: just have a wire that only sends data in one direction. If you want to be extra paranoid, make it an optical link. Or wireless transmit-only if that fits your application. Downside is you need more bandwidth since you can't have the receiver ask for a specific subset of data. The trouble always starts when someone wants remote inputs for some reason. Then you really need to start to think about a) how to protect the gateway systems and b) how to make sure that even if the gateway is cracked the damage is limited.
- dreamcompiler 6y ago
  > why can't they design physical safety relays/cutoffs? They can and they do. Or at least "they" used to. Nowadays such safety devices are very often software enabled. Because it's cheap and also because it checks a box on the marketing brochure that every customer wants: "Software upgradability for lower maintenance cost and reduced down time." Oh the irony.