The gap between IT and Control systems keeps getting bigger – continued

April 22nd, I wrote the following blog: As part of on-going Smart Grid efforts, IEEE issued the draft standard P1547.4/D10.0 1 Draft Guide for Design, Operation, and Integration of Distributed Resource Island Systems with Electric Power Systems for balloting ending April 17, 2010. The draft standard addresses microgrids in electric power systems and provides alternative approaches and good practices for design, operation, and integration. The document is intended to provide an introductory overview and address engineering concerns of distributed resources. The document is a very good engineering document. However, it does not mention cyber security even once.

I just reviewed IEEE P1676™/D1.0 Draft Guide for Control Architecture for High Power Electronics (1 MW and Greater) Used in Electric Power Transmission and Distribution Systems, dated July 2010 for the ballot closing July 30th. This standard is used for Smart Grid as well as NERC CIP assets. In the System Layer description, it states the following: "The system control layer sets operating modes, receives status information, and sends control loop settings and set-points in the application and converter control layers. The system control layer communicates with lower layers through fiber optic Ethernet using the TCP/IP for transportation of the data. Riding on the TCP/IP is the Application Protocol Data Unit (APDU) utilizing the IEC60870 standard protocol. The communication between the system control layer and lower layers is asynchronous in that it depends on both network traffic and frequency of requests from the system control layer." The document is a very good engineering document. However, cyber security is not mentioned once in the entire specification nor any firewalls or any other form security shown in the architecture. 

As shown by the Siemens PLC problem and these two standards, the gap, or rather canyon, still remains between IT and control systems.

Joe Weiss