Making Power System Cybersecurity Part of the Engineering Process

### Overview In this presentation, the speaker discusses bridging the gap between operational power system engineering and cybersecurity by making cyber controls an integral part of the standard engineering, design, testing, and commissioning workflows. Historically, cybersecurity in operational technology (OT) has often been bolted on post-deployment or handled predominantly by back-office IT and compliance bodies unfamiliar with grid operations. To resolve this, working groups within the IEEE Power System Communications and Cybersecurity Committee are establishing standardized frameworks that allow licensed professional engineers and settings engineers to document and test cyber protections directly within engineering schematics and operational processes.

### Key Topics - **Engineering Design & Standardized Documentation:** Traditional power systems rely on standardized drawings and function codes (such as IEEE PC37.2 relay protection codes like 50, 51, and 87) that clearly define what an intelligent electronic device (IED) or remote terminal unit (RTU) does. The speaker highlights an ongoing IEEE effort to create standard function codes for cybersecurity controls (e.g., local logging, role-based access control, complex passwords, protocol/port enables) directly on operational one-line diagrams. - **Testing and Commissioning (IEEE P2658):** Standard power system commissioning mandates rigorous point-to-point and end-to-end testing, but cyber controls frequently go unverified in the field. The working group is developing an IEEE guide (IEEE P2658) defining formal procedures for field commissioning, back-office application verification, and decommissioning/disposal of assets. - **Shifting Responsibility to Field Engineers:** The responsibility for securing edge devices (such as relays, reclosers, and RTUs) must shift away from back-office IT, compliance-focused groups, and threat-intel whack-a-mole approaches back toward the power system, telecommunications, and settings engineers who configure device-native parameters and communication schemes.

### Technical Details - **IEEE 1686 Compliance:** Modern IEDs built to IEEE 1686 already possess native security capabilities including local event logging, failed login attempt tracking, role-based access control, and password complexity. However, without engineering drawings mandating their configuration, these features often remain unused or unmonitored. - **Mapping Cyber Controls to Operational Diagrams:** Proposed drawing conventions show function codes—such as C54 for local event logging, C71 for password complexity, C66 for role-based access control, and C60/C68 for specific network service configurations (e.g., HTTP and Telnet). Routing considerations, including data diodes for fault analytics and VLAN segmentation across substation switches, can be explicitly captured. - **Alarm Integration and Cyber Lockout:** Substations can leverage RTUs as cyber concentrators by mapping cyber events directly into DNP3 points or converting them into syslog messages without overloading bandwidth. The speaker also notes simple mechanical interventions, such as a hardware-based remote lockout switch (estimated at around fifteen dollars) to block incoming control commands during suspected incidents like Ukraine 2015. - **Field Realities & Application Verification:** A real-world audit revealed that over half of an asset owner's firewalls were misconfigured (which simple ping checks could have caught), and enabled cyber alarms in IEDs failed to route anywhere. Formal application testing in lab environments is necessary to verify performance under constraints, such as identifying dropped packets or limitations when evaluating encryption over protocols like IEC 61850.

### Takeaways - Cyber controls must be specified on engineering drawings so that if an element is not documented, it is recognized as nonexistent in the design philosophy. - Establishing clear testing and commissioning procedures creates accountability across design engineers, integrators, and asset owners while providing as-built documentation for troubleshooting and incident response. - Engineers and industry practitioners are encouraged to participate in open IEEE standards working groups to shape the common technical language and guides governing power system cyber resilience.