A control center receives data from substations and other centers over protocols such as IEC 101/104, DNP3, ICCP/TASE.2 and OPC, and sends commands from there. Securing it combines a segmented electronic perimeter, secure remote access, physical security, port management, patching and malware protection, event monitoring, and response and recovery plans. NERC CIP-012 adds protection of the data exchanged between control centers.
What a control center does and why it is a target
The control center gathers data from substations, plants and other centers, and from there switching operations are ordered on grid equipment. Its SCADA system acquires and presents the data, and the EMS (energy management system) uses it for analysis and control of the power system. If an attacker compromises it, they can see the state of the grid, alter what the operator sees or send commands. What a digital twin adds to a control center, and what its limits are, is explained in Digital Twin in Control Centers.
That is why control center security is designed with availability and integrity requirements ahead of confidentiality: losing or falsifying a real-time value is worse than disclosing it.
Communication protocols
| Protocol | Typical use |
|---|---|
| IEC 60870-5-101 | Serial communication between the center and field remotes |
| IEC 60870-5-104 | Extension of 101 over Ethernet and TCP/IP networks; common for the link to the center |
| DNP3 (IEEE 1815) | RTUs, IEDs and master stations; very widely used in North America |
| ICCP / IEC 60870-6 TASE.2 | Real-time data exchange between control centers |
| OPC | Common interface for applications to exchange data inside the center |
Many of these protocols were designed before today’s threats and neither encrypt nor authenticate on their own. For those that allow it, the IEC 62351 series defines how to add security: IEC 104 and DNP3 with TLS and MMS and TASE.2. The path from the substation is covered in IEC 61850 to the control center.
Most frequent threats
- Phishing, which tricks a person into revealing credentials or opening a link. The usual response includes changing credentials, assessing the scope and spam filtering.
- Ransomware, which encrypts data and demands payment to recover it. It is reduced through patching, segmentation, network isolation, backups and tested restoration.
- Advanced persistent threats (APT), which operate stealthily through multiple paths for a long time and require specific detection tools.
- Management failures: unmanaged vendor default configurations, badly assigned permissions, no vulnerability management.
The 2015 and 2016 attacks on Ukraine’s power grid showed that substations can end up being manipulated through the IT network and operator credentials. That is the reason for separating IT and OT.
Control center controls
The areas of analysis, taken from the NERC CIP requirements, are:
| Area | What it covers |
|---|---|
| Electronic perimeter | Segmentation with firewalls and DMZ; access only through defined points |
| Secure remote access | VPN with two-factor authentication; intermediate sessions, no direct access to the devices |
| Physical security | Access to hardware, visitor control, maintenance |
| Ports and services | Only the necessary ones enabled |
| Patching | Process to assess and apply updates |
| Malicious code | Antivirus, application allowlisting, file integrity monitoring |
| Event monitoring | Centralized and reviewed logs |
| Access control | User directory, passwords, roles |
| Incidents and recovery | Response plan and tested backups |
- Substations and other centers
- Link with secure protocol (TLS or protected channel)
- Control center firewall and DMZ
- SCADA/EMS servers in the operations zone
- Operator workstation
Monitoring without opening a new door
A security operations center (SOC) watches over the platform: monitoring, event correlation, incident management, vulnerability analysis and early warnings. In OT this has to be done without altering the SCADA. A common architecture uses independent networks and equipment, mirror ports on the switches, collectors and sensors, and one-way communications to the SOC. The 104 and ICCP links are watched as well. The conceptual basis is in network security monitoring, IEC 62351-7.
Communications between control centers: CIP-012
The CIP-012 standard addresses communications between control centers. It requires a plan to mitigate the cybersecurity risks of the data transmitted between them. In practice, the links and the data exchanged (for example, over ICCP) are identified, and the plan defines how their integrity and authenticity are protected and how their loss is detected. It is the requirement closest to IEC 62351-4. The protection of real-time data between control centers that CIP-012 requires is covered in NERC CIP-012: Communications Between Control Centers.
Common mistakes
- A single network for office and operations.
- Vendor remote access without an intermediate session or two-factor authentication.
- Unencrypted ICCP or 104 links with no monitoring.
- Shared accounts on operator workstations.
- Patches applied without testing, or never applied.
- Backups with no tested restoration.
How we can help
At Tiza Group we assess the architecture of your control center and of its links with substations against NERC CIP and the cybersecurity requirements of your grid operator or utility, with a gap assessment, and we support the implementation as part of our substation and plant cybersecurity service. Remote work is available worldwide; on-site work is done in Colombia, or elsewhere on request. Contact us with the scope of your project.
Related guides
- IEC 61850 to the control center
- IEC 62351-4: MMS and TASE.2
- Secure IEC 104 and DNP3
- Secure remote access to substations
- NERC CIP: what it requires
- Cyberattack Trends in the Power Sector
- NERC CIP-012: Communications Between Control Centers
- Digital Twin in Control Centers
References
- NERC, CIP-005, CIP-006, CIP-007 and CIP-012.
- IEC 60870-5-101/-104, IEC 60870-6 (TASE.2) and IEC 62351.
- IEEE 1815, Standard for Electric Power Systems Communications – Distributed Network Protocol (DNP3).
Frequently asked questions
Which protocols link a control center with substations?
The most common are IEC 60870-5-101 (serial), IEC 60870-5-104 (over TCP/IP) and DNP3 (IEEE 1815). Between control centers, ICCP is used, also called IEC 60870-6 TASE.2. OPC is used to integrate applications inside the control center itself.
What does CIP-012 cover?
It requires a plan to mitigate the cybersecurity risks of data transmitted between control centers. It does not mandate a single mechanism: the plan describes how the confidentiality, integrity and availability of that data are protected.
Why is control center monitoring done with an independent architecture?
So that the SCADA segments are not altered. Mirror ports on the switches, collectors and one-way communications to the security operations center are used, so that monitoring does not open a way into the operations network.