Physical Security Protections
Alert on possible malicious physical activity with a physical sensor components on the SEL-3622. The SEL-3622 can detect sudden movement (through an embedded accelerometer), sudden changes in visible light (through an embedded light sensor), the opening of cabinet doors (through an input sensor), and the connection and disconnection of Ethernet cables.

Secured Proxy Access to Relays and IEDs
Use the SEL-3622 to provide a central point of entry to critical cyberassets, including those from SEL and others, with user-based access control and detailed activity logs.

IED Password Management
Enforce strong passwords on IEDs, and have them automatically changed on a configurable schedule. Satisfy regulatory password requirements, and ensure that no weak or default passwords are in use.

Substation Firewall
Secure your substation network from malicious traffic with a powerful deny-by-default firewall. Manage status and configuration with an intuitive, menu-driven web interface. Use virtual local-area networks (VLANs) to segregate traffic and improve network organization and performance.

Routing and NAT
Forward communications among separate Ethernet networks with static routes. The device supports Network Address Translation (NAT) for a wide variety of dynamic network applications. Port forwarding enables the use of a similar remote address space without redesigning IP subnets, and the outbound NAT supports Internet access for those applications that require it.

IPsec VPN
Integrate with existing IT and control systems over VPN tunnels that are secured using IPsec. Use X.509 certificates with Online Certificate Status Protocol (OCSP) to centrally manage VPN trust.

Exe-GUARD Allowlist Antivirus
Protect against known and unknown malware with embedded allowlist antivirus. Reduce patch cycles and resist zero-day attacks without additional settings.

Analog Bit-Based Protocol Conversion
Transform Conitel and other bit-based protocols to Ethernet, and reduce reliance on expensive analog circuits.

User Activity Reports
Log and time-stamp user access events and every command. Integrate event records into existing log management systems using Syslog.

Single Sign-On
Log on to the SEL-3622, not individual IEDs. Users have a single account and password to remember—their own. Manage user accounts and group memberships centrally using LDAP-accessible systems, such as Microsoft Active Directory, or RADIUS. RADIUS allows you to enhance security with multifactor authentication, such as RSA SecurID.

Support NERC CIP Requirements
Implement strong user-based access controls to the electronic security perimeter (ESP) while protecting IEDs with strong passwords and blocking shared or default accounts. Granular access controls limit users' access to their assigned roles on individual IEDs.

Industry-Vetted Security and Interoperability

• IRIG-B time synchronization receives and distributes the IRIG-B signal to maintain time synchronization.
• X.509 certificates ensure strong authentication for incoming connection requests.
• OCSP certificate revocation operates with standard certificate servers to centrally revoke certificates and prevent unwanted connections.
• HTTPS web interface allows convenient, secure setup and management and eliminates the need for extra PC software.
• Syslog logs events for consistency and compatibility and enables centralized collection.
• IPsec (RFC 4301, 4302, 4303) creates a secure VPN.
• Lemnos interoperability facilitates communications between Cisco routers and Lemnos-compliant devices.

Virtual Software Client Support
Transform unsecured serial or legacy Ethernet communications on Windows computers to cryptographically secure channels by using SEL-5827 or SEL-5828 Software. These applications are provided for free by SEL to make remote SEL-3622 ports available for existing software and terminal applications on your PC, including those using Modbus TCP/RTU. Data are secured using SSH with SEL-3622 port groups, master ports, and serial ports.

Download the SEL-5827 or SEL-5828.