Toward a Framework for Managing Information Security for an Electric Power Utility—CIGRÉ Experiences

This paper deals with the increasingly important issue of proper handling of information security for electric power utilities. It is based on the efforts of CIGRE Joint Working Group (JWG) D2/B3/C2-01 on "Security for Information Systems and Intranets in Electric Power System" carried out between 2003 and 2006. The JWG has produced a technical brochure (TB), where the purpose to raise the awareness of information and cybersecurity in electric power systems, and gives some guidance on how to solve the security problem by focusing on security domain modeling, risk assessment methodology, and security framework building. Here in this paper, the focus is on the issue of awareness and to highlight some steps to achieve a framework for cybersecurity management. Also, technical considerations of some communication systems for substation automation are studied. Finally, some directions for further works in this vast area of information and cybersecurity are given.

I. Introduction

As providers of essential products and services for the society, electric power utilities (EPUs) need to develop new security systems and procedures that are responsive to the improvements in technology and also recognize the development of threats and attacks. As the computer networks and systems for administrative issues and power system control systems become more interconnected, a traditional hardware-oriented approach is not appropriate for handling of those networks/systems. Rather an overall domain concept is needed. This implies that utilities not only need to deal with physical intrusion, but also with cyber intrusion.