In the context of digitalization, the demand for cyber security is also growing enormously. “For example, 11% of German companies recorded an IT security incident in the past 12 months. Three out of ten companies expect to be targeted by cyber criminals in the next 12 months – organized gangs are particularly feared. The Ukraine war is fueling fears of more cyberattacks in this regard. [1]” The area of critical infrastructure, that which virtually keeps us alive on a daily basis, requires extra attention. For example, the electrical infrastructure, which will be highlighted in this article. The Swiss daily newspaper Tagesanzeiger (TA), for example, postulates in a “Survey on cyber security: Swiss electricity suppliers are insufficiently protected against hackers. The companies are particularly poor at recognizing attacks as well as responding to them. [2]”

This white paper addresses the fundamental dangers, the status quo, the laws in force in the EU as well as the currently practicable and available solutions in the context of electrical measuring instruments.

Due to the dynamic and challenging complexity of the topic, this report is intended as a guide and is not intended to be exhaustive.

Threat scenarios

Basically, it can be said that we know two main categories of possible risks. One is data theft [3] and the other is data manipulation. [3] Intentionally or unintentionally. By accident or by criminal acts.

For better segmentation, we list, as always non-exhaustively, some of the threat scenarios as follows in addition:

1. Hack attack on company with extortion, data encryption, theft, threats, …
   (e.g. by ransomware (Lockbit, …), malware, …)
2. Failure and attack on (externally hosted) services
   (e.g. websites, social media accounts, cloud services, data backup services, …)
3. Espionage and phishing attacks
   (e.g. through interviews, surveys, virtual & physical spying, unknown visitors, credit card leaks, …)
4. Cyber attacks on individuals
   (e.g. blackmail and threats against individuals, smartphone applications (e.g. camera, microphone), …)
5. Losses
   (e.g. simple data loss, hardware loss, hardware theft, …)
6. Conscious data exchange
   (e.g. through external data carriers (USB sticks, SD cards, smartphone…), EDI, API, …)
7. Physical & Physical Influences
   (e.g. lightning, fire, water, vandalism, sabotage, …)
8. Malfunction & failure of data backup
   (e.g. NAS, inadequate documentation, inadequate updates, long power outages, defective media carriers, aging, …)
9. Lack of awareness in the company itself
   (e.g. general ignorance and naivety, lack of ICT knowledge, no “boss thing”, lack of training, …)
10. Inadequate equipment
    (e.g. outages, legacy systems, virus on smartphone, unknown number of ICT clients, third-party devices in ICT network, …)

In particular, the point “third-party devices in the ICT network” should concern us here in the article, as this also affects measuring instruments and thus also reflects the above-mentioned threat scenarios.

The new importance of data flows in electrical distribution networks

• Electrical interconnected grids must be able to communicate with each other
• Integration into the World Wide Web takes place (www)
• Integration of more metering points due to the many nodes is necessary (especially in the low-voltage network = smart grid)
• Users on grid level 7 (local distribution grid <1kV) become (app) specialists (e.g. SmartHome, energy procurement, CO2 footprint, …)
• Smart grid applications are necessary and also demanded (e.g. smart grids, create transparency, automations, real time, …)
• Planning with simulation, real-time data and trends are becoming increasingly important for networks
• Dynamic load and power management = remote control (e.g. redispatch, §14a EnWG (Germany), PV plants without counter load, …)
• Today’s control centers are connected with parallel applications (e.g. for smart grid)
• Cloud solutions come to the electrical grids
• Disturbances and changes (dynamics) must be recorded in real time
• New disturbing and influencing factors appear (e.g. renewable energies like cloud formation, wind, heat, …)
• …

Excursus: Energy Industry Act (EnWG) – Controllable consumption devices:

The new version of §14a EnWG (01.01.2023) of Germany provides for a reduction of grid fees for those consumers who have concluded an agreement with the grid operator on the grid-oriented control of controllable consumption devices or grid connections with controllable consumption devices. [4]

In a nutshell: “From 2024, the low-voltage grid is to be gradually expanded into a smart grid as part of §14a EnWG. The first expansion stage for each distribution grid operator is the static control of disconnectable loads at the low-voltage grid level, which is to be replaced by dynamic control by 2029 at the latest.

In the low-voltage grid, the term disconnectable loads refers to all loads with a connected load greater than 3.7 kW. This primarily includes heat pumps, electrical storage units, charging infrastructure for electric vehicles or air conditioning systems.” [5]

Thus, data flows and volumes will increase significantly and it is likely that other countries with urban and complex infrastructures could follow a similar principle.

Which strategies are used for data and manipulation security

This paragraph deals in principle with the possible elements of cyber security that are considered. It is always striking how little is said specifically about operational technology (OT) in the context of integrated field devices (e.g., sensors, measuring instruments, etc.).

• Definition of a company-specific I(C)T policy
• Employment of internal as well as external IT specialists in respective areas of expertise
• Operate closed, or isolated, networks
• Strict compliance with country-specific guidelines and laws on the subject of data protection
• Reduce proprietary systems (e.g., proprietary vendor interfaces).
• Use of standardized protocols (e.g. IEC61850, PQDIF IEEE1159.3, etc.)
• Use of additional software solutions for monitoring
• Centralization of systems (hardware, software, HR)
• Outsourcing of services to external service providers
• Insourcing of outsourcing services
• Segmentation of the network to minimize possible attack surfaces
• Use of auditable security standards (e.g. ISO27001, individual, etc.)
• …

Insight into ISO27001 – a viable approach?

This International Standard has been developed to establish requirements for the establishment, implementation, maintenance and continuous improvement of an Information Security Management System (ISMS).

The introduction of an information security management system represents a strategic decision for an organization. The creation and implementation of such a system within an organization depend on its needs and goals, security requirements, organizational processes, and the size and structure of the organization. It can be assumed that all of these influencing variables will change over time.

The information security management system maintains the confidentiality, integrity and availability of information using a risk management process and gives interested parties confidence that risks are being managed appropriately.

It is important that the information security management system is integrated into the organization’s overall governance structure as part of its operations, and that information security is considered at the design stage of processes, information systems and measures.

It is expected that the implementation of a security system (ISMS) will be scaled according to the needs of the organization.

This standard is joined by IEC62443. This in turn describes a holistic approach to cyber security. And this down to the component level within industrial automation.

Source references

[1] https://www.tuev-verband.de/studien?tx_news_pi1%5Bnews%5D=671 [07.07.2023]

[2] https://www.tagesanzeiger.ch/schweizer-stromversorger-sind-ungenuegend-gegen-hacker-geschuetzt-686630607216 [02.07.2021]