performing-power-grid-cybersecurity-assessment

执行电网网络安全评估

何时使用

• 当按照 NERC CIP 要求对电网设施开展周期性网络安全评估时
• 当评估使用 IEC 61850 GOOSE 和 MMS 协议的变电站自动化系统时
• 当评估能量管理系统（EMS）或 SCADA 控制中心的安全性时
• 当评估同步相量（PMU）网络和广域监测系统时
• 当为区域实体合规审计或内部安全审查做准备时

不要使用于低于 NERC 注册阈值的非 BES 系统、不具备电网特定内容的通用 OT 评估（参见 performing-ot-network-security-assessment），或不涉及网络范围的发电设施物理安全评估。

前置条件

• 理解电网架构（发电、输电、配电）
• 熟悉 NERC CIP 标准和 BES 网络系统分类
• 了解电网协议（IEC 61850、IEC 60870-5-104、DNP3、ICCP/TASE.2）
• 用于变电站网络流量分析的被动监控工具
• 可访问 EMS/SCADA 架构文档和网络图

工作流

步骤 1：绘制电网网络架构

识别并记录所有支持电网运行的网络系统，包括 EMS、SCADA、变电站自动化和通信基础设施。

# Power Grid Cyber Architecture Assessment
facility_type: "Regional Transmission Organization Control Center"

ems_systems:
  primary_ems:
    vendor: "GE Grid Solutions"
    product: "EMS/SCADA (formerly XA/21)"
    functions:
      - "State estimation"
      - "Automatic generation control (AGC)"
      - "Security-constrained economic dispatch"
      - "Contingency analysis"
    protocols:
      - "ICCP/TASE.2 (inter-control center)"
      - "DNP3 (substation RTU polling)"
      - "IEC 60870-5-104 (substation polling)"

  backup_control_center:
    location: "Geographically diverse backup site"
    sync_method: "Real-time database mirroring"
    switchover_time: "< 5 minutes"

substation_automation:
  count: 145
  system_types:
    - vendor: "ABB"
      product: "RTU560"
      protocol: "DNP3 over TCP/IP"
      count: 85
    - vendor: "SEL"
      product: "SEL-3530 RTAC"
      protocol: "IEC 61850 MMS + GOOSE"
      count: 40
    - vendor: "Siemens"
      product: "SICAM A8000"
      protocol: "IEC 60870-5-104"
      count: 20

  communications:
    primary: "MPLS WAN (carrier-provided)"
    backup: "Licensed microwave radio"
    last_mile: "Fiber optic to substation"

synchrophasor_network:
  pmu_count: 75
  pdc: "GE PDC (Phasor Data Concentrator)"
  communication: "IEEE C37.118.2 over dedicated network"
  data_rate: "30-60 samples per second"

步骤 2：评估变电站自动化安全

评估基于 IEC 61850 的变电站自动化的协议安全、访问控制和网络分段。

#!/usr/bin/env python3
"""Power Grid Substation Security Assessor.

Evaluates security of IEC 61850-based substation automation
systems including GOOSE messaging, MMS client/server, and
network architecture.
"""

import json
import sys
from dataclasses import dataclass, field, asdict
from datetime import datetime


@dataclass
class SubstationFinding:
    finding_id: str
    severity: str
    category: str
    title: str
    description: str
    affected_systems: list
    nerc_cip_ref: str
    iec_62351_ref: str
    remediation: str


class SubstationAssessment:
    """Assesses cybersecurity of substation automation systems."""

    def __init__(self, substation_name):
        self.name = substation_name
        self.findings = []
        self.counter = 1

    def assess_iec61850_security(self, config):
        """Assess IEC 61850 protocol security."""

        # GOOSE message authentication
        if not config.get("goose_authentication"):
            self.findings.append(SubstationFinding(
                finding_id=f"SUB-{self.counter:03d}",
                severity="critical",
                category="Protocol Security",
                title="IEC 61850 GOOSE Messages Lack Authentication",
                description=(
                    "GOOSE messages used for protection signaling between IEDs "
                    "are not authenticated. An attacker on the station bus could "
                    "inject false trip/close commands to circuit breakers."
                ),
                affected_systems=config.get("goose_publishers", []),
                nerc_cip_ref="CIP-005-7 R1.5 - ESP internal communications",
                iec_62351_ref="IEC 62351-6 - GOOSE/SV authentication",
                remediation=(
                    "Implement IEC 62351-6 GOOSE authentication using digital "
                    "signatures. Deploy VLAN isolation for GOOSE traffic as interim."
                ),
            ))
            self.counter += 1

        # MMS service access control
        if not config.get("mms_authentication"):
            self.findings.append(SubstationFinding(
                finding_id=f"SUB-{self.counter:03d}",
                severity="high",
                category="Protocol Security",
                title="MMS Client Connections Lack Authentication",
                description=(
                    "MMS (Manufacturing Message Specification) connections to IEDs "
                    "do not require client authentication. Any device on the station "
                    "bus can read/write IED configuration and operate breakers."
                ),
                affected_systems=config.get("mms_servers", []),
                nerc_cip_ref="CIP-007-6 R5 - System Access Controls",
                iec_62351_ref="IEC 62351-4 - MMS security profiles",
                remediation="Enable TLS for MMS connections per IEC 62351-4.",
            ))
            self.counter += 1

        # Station bus segmentation
        if not config.get("station_bus_segmented"):
            self.findings.append(SubstationFinding(
                finding_id=f"SUB-{self.counter:03d}",
                severity="high",
                category="Network Architecture",
                title="Flat Station Bus Network Without Segmentation",
                description=(
                    "Station bus connects all IEDs, HMI, engineering access, "
                    "and WAN gateway on a single VLAN without segmentation."
                ),
                affected_systems=["All station bus devices"],
                nerc_cip_ref="CIP-005-7 R1 - ESP boundary",
                iec_62351_ref="IEC 62351-10 - Security architecture",
                remediation=(
                    "Segment station bus into VLANs: protection IEDs, "
                    "measurement IEDs, station HMI, and WAN gateway."
                ),
            ))
            self.counter += 1

    def assess_remote_access(self, config):
        """Assess remote access security for substations."""
        if config.get("direct_vendor_access"):
            self.findings.append(SubstationFinding(
                finding_id=f"SUB-{self.counter:03d}",
                severity="critical",
                category="Remote Access",
                title="Direct Vendor Remote Access to Substation Without MFA",
                description=(
                    "Vendor support has direct VPN access to substation network "
                    "without traversing an intermediate system or requiring MFA."
                ),
                affected_systems=["Substation WAN gateway"],
                nerc_cip_ref="CIP-005-7 R2 - Remote Access Management",
                iec_62351_ref="IEC 62351-8 - Role-based access control",
                remediation=(
                    "Route vendor access through corporate jump server with MFA. "
                    "Implement session recording per CIP-005-7 R2.4."
                ),
            ))
            self.counter += 1

    def generate_report(self):
        """Generate substation assessment report."""
        report = []
        report.append("=" * 70)
        report.append(f"SUBSTATION CYBERSECURITY ASSESSMENT: {self.name}")
        report.append(f"Date: {datetime.now().isoformat()}")
        report.append("=" * 70)

        for sev in ["critical", "high", "medium", "low"]:
            findings = [f for f in self.findings if f.severity == sev]
            if findings:
                report.append(f"\n--- {sev.upper()} ({len(findings)}) ---")
                for f in findings:
                    report.append(f"  [{f.finding_id}] {f.title}")
                    report.append(f"    {f.description[:100]}...")
                    report.append(f"    NERC CIP: {f.nerc_cip_ref}")
                    report.append(f"    Remediation: {f.remediation[:80]}...")

        return "\n".join(report)


if __name__ == "__main__":
    assessment = SubstationAssessment("Substation Alpha - 345kV")

    assessment.assess_iec61850_security({
        "goose_authentication": False,
        "mms_authentication": False,
        "station_bus_segmented": False,
        "goose_publishers": ["SEL-411L-01", "SEL-411L-02", "SEL-487E-01"],
        "mms_servers": ["SEL-3530-RTAC", "ABB-REF615-01"],
    })

    assessment.assess_remote_access({
        "direct_vendor_access": True,
    })

    print(assessment.generate_report())

关键概念

术语	定义
IEC 61850	变电站通信网络和系统的国际标准，使用 GOOSE 进行保护信号传输，使用 MMS 进行 SCADA 数据传输
GOOSE	面向通用对象的变电站事件 - 用于 IED 之间快速点对点保护信号传输的多播协议（跳闸时间 < 4ms）
MMS	制造报文规范 - 用于读取/写入 IED 数据和操作断路器的客户端/服务器协议
IEC 62351	电力系统通信协议的安全标准系列，为 IEC 61850、DNP3 和 IEC 104 提供认证和加密
ICCP/TASE.2	控制中心间通信协议，用于不同电力公司控制中心之间的数据交换
同步相量（PMU）	相量测量单元，提供每秒 30-60 个采样的时间同步电压/电流测量，用于广域监测

工具与系统

• Dragos Platform：OT 安全平台，具有针对电网目标组织（ELECTRUM、KAMACITE）的特定威胁情报
• SEL-3620 以太网安全网关：变电站安全设备，提供加密、访问控制和入侵检测
• GRIDsure：由 Idaho National Laboratory 开发的电网网络安全评估框架
• 带 IEC 61850 解析器的 Wireshark：用于变电站中 GOOSE 和 MMS 流量的协议分析

输出格式

Power Grid Cybersecurity Assessment Report
=============================================
Facility: [Name and Type]
NERC Registration: [Entity ID]
BES Impact Rating: [High/Medium/Low]

SUBSTATION FINDINGS: [N]
EMS/SCADA FINDINGS: [N]
COMMUNICATION FINDINGS: [N]

NERC CIP COMPLIANCE:
  CIP-002: [Status]
  CIP-005: [Status]
  CIP-007: [Status]