Secure remote access to relays and substations

Short answer

Secure remote access to a substation never connects the engineer's computer straight to the relay. It goes through a VPN with multi-factor authentication that terminates on a jump server in the DMZ; from there, only during an approved session and with a personal account, it reaches the intended relays through a firewall, and the whole session is logged.

Why remote access is needed

Reviewing an event, downloading an oscillography record or changing a setting no longer requires a trip to the substation. Remote access saves hours of travel and allows a quick response to a trip. But every path from the outside to a protective relay is also a path for an attacker. The question is not whether to provide remote access, but how to provide it in a controlled way.

The guide on whether remote relay configuration is secure answers the question from the side of the client hiring the service. This guide describes the technical architecture that makes it possible.

What not to do

A modem or cellular router connected straight to the relay or to the substation switch.
Remote desktop software installed on the control house computer and exposed to the internet.
Shared accounts for the whole maintenance team, with the factory password.
A VPN that drops the user into the whole protection and control network, with no restriction on destinations.
Permanent access that nobody closes when the work is done.

Any of these breaks the IEC 62443 segmentation into zones and conduits and leaves the protection exposed.

The architecture

The usual architecture places several controls in series, so that defeating one is not enough to reach the relay:

Path of secure remote access to a relay

01VPN with multi-factor authenticationThe engineer authenticates with a personal account
02DMZ and jump serverThe VPN terminates here, never on the protection and control network
03Session approvalThe asset owner approves who, which devices and for how long
04Substation firewallOnly lets traffic through from the jump server to the intended relays and their engineering ports
05RelayPersonal account and role on the IED itself, with its security event log

1. VPN with multi-factor authentication. The engineer connects with a personal, non-shared account and a second factor. The VPN encrypts the traffic from the engineer’s machine and terminates in the DMZ.

2. DMZ and jump server. The DMZ is an intermediate zone between the external network and the substation network. The jump server is the only point from which the relays can be reached. The engineering software lives there; the engineer’s computer never talks to the relay.

3. Approval and access windows. Each session is approved beforehand: who connects, to which devices and for how long. Outside that window, the account has no access.

4. Substation firewall. It only allows traffic from the jump server to the intended relays, and only on the engineering software ports. Everything else is blocked and logged.

5. The relay itself. Accounts per person and per role, as defined by the role-based access control of IEC 62351, and logging of logins and changes, a capability described in IEEE 1686.

Recorded sessions and logging

VPN log: who connected, from where and when.
Jump server log: which programs were opened and which devices were reached; in many installations, a screen recording of the session.
Firewall log: allowed and blocked flows.
Relay log: logins, settings and configuration changes.

With all four, any intervention can be reconstructed. In addition, every settings change is documented with the previous and the new version, and with the name of the person who approved it.

Account and change management

The architecture is of little use if accounts are not managed. The usual practice is:

Account creation and removal tied to each external person’s contract, with an expiry date.
Periodic review of who has access and to which devices.
Factory passwords changed on every relay, switch and gateway before commissioning.
A copy of the settings before and after each intervention, stored outside the relay.

What regulation requires

NERC CIP-005 (North America), for interactive remote access to high and medium impact systems: an intermediate system, so that the device initiating the session does not reach the asset directly; encryption that terminates at that intermediate system; and multi-factor authentication. The power sector cybersecurity guide covers it in more detail.
Elsewhere, the local regulation and the utility’s cybersecurity requirements set the rules.
IEC 62443-3-3: identification, authentication, use control and logging requirements that the architecture above puts into practice.

When there is no infrastructure yet

Many medium-voltage and industrial substations have no DMZ or jump server. The reasonable options, in general, are:

an industrial router with a firewall that terminates the VPN and only allows the intended relays to be reached;
access enabled by the asset owner only during the work window, and disabled when it ends;
a personal account for each external engineer.

This does not replace a full architecture, but it avoids the mistakes listed above. The equipment for this is covered in industrial router and firewall and radio and cellular links.

Remote relay configuration with Tiza Group

Our core service is remote relay configuration, worldwide: we work on your relays and recloser controls only through the access you control, with approved sessions, personal accounts and a log of every change, in medium-, high- and extra-high-voltage substations and industry. If your substation does not yet have secure access, we design it as part of our communications engineering service. Write to us with the make and model of your relays.

References

IEC 62443-3-3:2013, system security requirements and security levels.
IEC 62351-8: role-based access control for power system management.
IEEE 1686-2022, Standard for Intelligent Electronic Devices Cybersecurity Capabilities.
NERC CIP-005, Cyber Security – Electronic Security Perimeter(s), requirement R2 on interactive remote access.

Frequently asked questions

Why should a modem never be connected straight to the relay?

Because it leaves the relay exposed with no control over who gets in, from where or when, with no logging and no way to cut off one person's access without affecting everyone else. A relay with a modem or a cellular router attached directly is an open door into the grid's protection.

What is a jump server?

It is a host in the DMZ through which every remote access must pass. The engineer connects to it, never directly to the protection and control network, and opens the engineering software from there. This centralizes authentication, the rules on which devices can be reached and the session log.

What does regulation require for remote access?

It depends on the country. In North America, NERC CIP-005 requires, for interactive remote access, an intermediate system, encryption that terminates at it, and multi-factor authentication. Elsewhere, the local regulation and the utility's requirements set the rules.