SEL-3622
Security Gateway
A router, VPN endpoint, and firewall device, the SEL-3622 Security Gateway can perform secure and proxy user access for a small number of serial- and Ethernet-based IEDs. The SEL-3622 helps create a user audit trail through strong, centralized, user-based authentication and authorization to modern and legacy IEDs. The SEL-3622 secures your control system communications with a stateful deny-by-default firewall, strong cryptographic protocols, and logs for system awareness. The SEL-3622 also manages protected IED passwords, ensuring that passwords are changed regularly and conform to complexity rules. The SEL-3622 supports enhanced security, enabling you to protect critical cyberassets with strong multifactor authentication technologies, such as RSA SecurID using Remote Authentication Dial-In User Service (RADIUS). With four IPsec profiles available, including 2022 Secure, which contains updated cipher suites, the SEL-3622 offers best-in-class encryption and authentication of information packets. The SEL-3622 resists known and unknown malware attacks with exe-GUARD embedded antivirus technology. Powerful rootkit resistance, embedded Linux mandatory access controls, and process allowlisting help mitigate attacks against the gateway itself and eliminate costly patch management and antivirus signature updates. The SEL-3622 supports NERC CIP v3 and v5 compliance efforts without needing Technical Feasibility Exceptions (TFEs). The SEL-3622 integrates physical awareness sensors through an onboard accelerometer, light sensor, and input contact sensor. The SEL-3622 also alerts when Ethernet cables are connected or disconnected, alerting operators to potential remote cyberattacks or physical equipment manipulation. The SEL-3622 supports SEL-5827 Virtual Connect Client and SEL-5828 Virtual Port Service Software. These applications are provided for free by SEL to make remote SEL-3622 ports available for existing software and terminal applications on your PC, including those using Modbus TCP/RTU. The SEL-3622 was designed and built in cooperation with the U.S. Department of Energy National SCADA Test Bed and the following companies:
- Schweitzer Engineering Laboratories, Inc.
- EnerNex Corporation
- Tennessee Valley Authority
- Sandia National Laboratories
Starting at
$1,140
Centralized Access to Relays and IEDs
Provide a central point of entry to critical cyberassets with user-based access controls and detailed activity logs. Log onto the SEL-3620, not individual IEDs. Manage user accounts and group memberships centrally using Lightweight Directory Access Protocol (LDAP)-accessible systems, such as Microsoft Active Directory. RADIUS functionality enables the use of multifactor authentication systems, such as RSA tokens.
IED Password Management
Enforce strong passwords on IEDs, and change the passwords automatically on a configurable schedule. Satisfy regulatory password requirements, and ensure that no weak or default passwords are in use. Manage passwords on IEDs that use command-line interfaces and on devices that use the Modbus protocol, such as GE UR series relays. At the same time, simplify device access with device checkout and common persistent passwords.
Substation Firewall and IPsec VPN Endpoint
Secure your substation network from malicious traffic with a powerful deny-by-default firewall. Manage status and configuration with an intuitive, menu-driven interface. Securely connect critical networks to the control center using Internet Protocol Security (IPsec) VPNs. Use X.509 certificates with Online Certificate Status Protocol (OCSP) to centrally manage trust.
Accurate Time Synchronization
Synchronize timing information even if a GPS satellite signal is temporarily unavailable. Sync with local communications processors, computers, and security devices using IRIG-B for synchrophasor-accurate timing and Network Time Protocol (NTP) over Ethernet for granular logging and event timing.
Secure Ethernet Communications
Use Media Access Control Security (MACsec) to enhance the existing cybersecurity of the SEL-651R and SEL-651RA recloser controls and reduce operation and maintenance expenses. MACsec secures Ethernet traffic (except IEC 61850 GOOSE and Parallel Redundancy Protocol traffic) between an SEL-651R/651RA and SEL-3622 or Key Server MACsec-enabled routers/radios, providing confidential communication and maintaining message integrity between devices. Key management is automated via the MACsec Key Agreement (MKA) to simplify commissioning and improve the overall user experience.
Central Authentication
Gain interactive access via a secured electronic access point (EAP) to the remote electronic security perimeter (ESP) using centralized credentials with SEL-3620 proxy services. Authorized users may access IEDs without needing to remember individual relay logins. Whether on the road, in the office, or on location at the substation, use existing terminal applications for command-line configurations, or acSELerator QuickSet SEL-5030 Software as a point-and-click graphical user interface (GUI) to make edits, view events, or check status information.
Virtual Software Client Support
Transform unsecure serial or legacy Ethernet communications on Windows computers to cryptographically secure channels by using SEL-5827 or SEL-5828. These applications are provided for free by SEL to make remote Security Gateway ports available for existing software and terminal applications on your PC, including those using Modbus TCP/RTU. Data are secured using Secure Shell (SSH) with remote port groups, master ports, and serial ports.
Strong Auditability Supports NERC CIP Requirements
Log and time-stamp user access and all commands entered on critical IEDs. Integrate event records into existing log management systems using Syslog. Protect IEDs with strong passwords, and block shared or default accounts. Granular access controls limit users' access to their assigned roles on individual IEDs. Generate specific reports for user activity, user accounts on the device, network ports and services, IED password updates, and password updates
Embedded Antivirus Algorithms
Resist known and unknown malware attacks against SEL Security Gateways with exe-GUARD embedded antivirus. Powerful rootkit resistance technology, embedded Linux mandatory access controls, and process allowlisting help mitigate attacks against the gateways themselves without additional settings or patch management requirements.
Physical Security Protections
Alert on possible malicious physical activity with physical sensor components on the SEL-3622. The SEL-3622 can detect sudden movement (through an embedded accelerometer), sudden changes in visible light (through an embedded light sensor), the opening of cabinet doors (through an input sensor), and the connection and disconnection of Ethernet cables.
Distribution Automation Security
Add the SEL-3622 to each cabinet, automate relay password management, and provide centralized strong authentication for field distribution controllers, such as the SEL-651R Advanced Recloser Control. The SEL-3622 establishes data confidentiality and integrity with IPsec VPN technology and a fully configurable firewall. At the control center, manage multiple remote SEL-3622 Security Gateways via acSELerator Team Security, and synchronize password management, reports, audit logs, and critical device event reports (SER data) with a central location. The SEL-3622 also provides alerts on physical disturbances, including changes in light intensity (via an embedded light sensor), changes in movement (via an onboard accelerometer), cabinet door status (via a contact input), and the connection status of Ethernet cables.
SEL-3622 Features
1
2
3
4
- Status LEDs
- Front Ethernet port
- Light sensor
- IRIG-B input
1
2
3
4
- 2 DB-9 EIA-232
- Rear Ethernet ports
- 2 DB-9 EIA-232/-422/-485 software-selectable serial ports, all with IRIG-B
- Cabinet door contact sensor input