Creating Effective Cyber Attack Mitigation Strategies

This is the first step in securing all external and internal network access points. This should also include USB ports that are potential vulnerability points for viruses and malware propagated via thumb drives. Disable unused communications ports. Network access points include the following:

• Supervisory control and data acquisition (SCADA)
• Energy management system (EMS)
• Engineering access
• Maintenance
• Telephone lines
• Wireless
• Internet
• Network interconnections

The SEL Engineering Services Cybersecurity Team provides a comprehensive range of professional security services that include critical infrastructure asset and firmware baselining. As part of this service, SEL creates up-to-date line diagrams of substation and plant facilities that include communications network diagrams and external and internal access points. SEL also provides security assessments to identify vulnerabilities and provide recommendations on how to secure the system.

An SEL Engineering Services security assessment includes recommendations for ensuring the implementation of alternative communications paths so critical services can mitigate the effects of denial-of-service attacks.

• Minimize the impact of denial-of-service attacks.
• Send security alarms through a second path.

All communications access points should be secured with user access controls and authentication procedures. In addition, all communications entering or exiting the electronic security perimeter (ESP) should be encrypted to prevent man-in-the-middle attacks.

SEL builds in security from the system level. Whether you need to manage one substation or hundreds, we create manageable, scalable solutions that make your system easier to control. SEL’s defense-in-depth philosophy applies cybersecurity in a layered approach that maximizes reliability and minimizes the intrusiveness of controls on existing critical processes. Besides physical security, SEL considers four digital zones of defense.

Keep your designs safe, and limit access to system details to those who have a need to know in order to do their jobs. Be especially careful to protect:

• Computers
• Passwords
• Software
• Instruction manuals
• Encryption equipment and keys

The SEL Engineering Services Cybersecurity Team provides comprehensive analyses of existing security measures. We review security plans, policies, and procedures as they relate to personnel, technology, and operations, including:

• Onsite inspection of control system communications and security hardware/software
• Evaluation of electronic and physical perimeters
• Assessment and documentation of open ports and/or services
• Onsite interviews of operations personnel regarding security procedures

SEL cybersecurity analyses include detailed reports, complete with findings and actionable suggestions for improvement.

A strong and effective security solution should have multiple layers of defense. SEL’s defense-in-depth philosophy applies cybersecurity in a layered approach to maximize the effectiveness of an organization’s security implementation. Defense-in-depth should include:

• Layering security for cyber assets
• Applying deny-by-default and whitelisting policies
• Encrypting all data leaving the electronic security perimeter (ESP) and data being transported across public or untrusted networks
• Implementing physical security
• Logging and monitoring of all physical and cyber activity
• Baselining, monitoring, and logging all firmware updates and settings changes
• Training personnel on security best practices
• Creating a security aware culture

The SEL Engineering Services Cybersecurity Team provides setup, documentation, and customer training on SEL defense-in-depth best practices, including:

• Physical security and cybersecurity
• User accounts
• Proxy services
• Access controls
• Logging
• Firewall rules
• VPNs
• Network security

Before a security attack occurs, your organization should have a clear, concise, and well-thought-out plan in place that details how your company will respond to a cyber incident.

The SEL Engineering Services Cybersecurity Team helps companies build incident response plans that include the following incident recovery services:

SEL equipment makes it easy to use and manage strong passwords. You can use virtually all printable ASCII characters and a password manager, such as KeePass or Lastpass, to generate long, complex passwords for each unique login you have.

SEL provides a comprehensive approach to effective password management. In addition to offering services to review security plans, policies, and procedures, SEL also creates solutions for the implementation of effective password management that include products and training.

The SEL-3620 Ethernet Security Gateway and SEL-3622 Security Gateway are solutions that secure all Ethernet and serial communications between the enterprise and remote networks. These solutions manage passwords for and secure access to IEDs with an authentication proxy that integrates Lightweight Directory Access Protocol (LDAP) and Remote Authentication Dial-in User Service (RADIUS) for multifactor authentication.

In addition to SEL products and solutions, SEL University also provides real-world, hands-on cybersecurity training to teach organizations how to implement strong electronic access controls using SEL solutions for protecting critical assets.

• Do not use default passwords.
• Change passwords periodically.
• Change passwords when people leave.
• Use different passwords in different regions.
• Control passwords.

There are practical steps you can take today to prepare your team and secure your critical assets.

At SEL, cybersecurity has always been an integral part of our company’s foundation, and we have a long history of developing the most secure products and solutions in the industry.

SEL believes that an effective cybersecurity program relies on creating a security aware culture with appropriate education and training. This link provides information and resources for building cybersecurity awareness, education, and training at your organization.