The Role of Network Segmentation in Enhancing Cybersecurity in Substation Communication Networks

Sammanfattning

Substations are going through an evolving stage of implementing intelligent electronic devices to empower automation, increase efficiency, and meet the requirements of today’s digitalized society. Exposing substations to the Internet has led to an accelerating rise in cyberattacks on the power grid. This study investigates how network segmentation improves the cybersecurity measures of a Substation Communication Network (SCN) based on factors relevant to Mälarenergi Elnät’s operational requirements. A literature-based theoretical analysis approach was conducted to evaluate how the cybersecurity measures of the different substation levels, such as bay, station, and process level, can be enhanced, employing physical segmentation, Virtual Local Area Network (VLAN) segmentation, and micro-segmentation. Lastly, an SCN topology architecture was proposed using the results of literature studies and an evaluation of constructive feedback from experts at Mälarenergi Elnät. The findings indicate that layered cybersecurity techniques are highly desirable to counter cyberattacks and reduce damage. Physical segmentation of an SCN is necessary to isolate legacy devices, reducing lateral movement caused by outdated devices. The challenge of using physical segmentation is the need for additional routable devices, creating unwanted network delay in a time-critical system. VLAN segmentation provides an efficient partition of critical substation data flows, reducing the potential of packet sniffing and traffic congestion. Micro-segmentation prevents lateral movement and reduces a threat actor's attack surface with firewall policies, although additional firewall policies add network delay. Therefore, cautious planning is needed to uphold the time-critical deadlines of the SCN. This study contributes to the rapid evolution of the power grid, providing inspiration to network architects of electric utilities regarding how to segment their SCN. This study may offer a foundation for evaluating segmentation methods to enhance cybersecurity in substations and other critical operational technology systems.