ABB Relion 670 series User manual

RELION® 670 SERIES
—
670 series
Version 2.2
Cyber security deployment guideline

Document ID: 1MRK 511 399-UEN
Issued: October 2017
Revision: B
Product version: 2.2.1
© Copyright 2017 ABB. All rights reserved

Copyright
This document and parts thereof must not be reproduced or copied without written
permission from ABB, and the contents thereof must not be imparted to a third
party, nor used for any unauthorized purpose.
The software and hardware described in this document is furnished under a license
and may be used or disclosed only in accordance with the terms of such license.
This product includes software developed by the OpenSSL Project for use in the
OpenSSL Toolkit. (http://www.openssl.org/) This product includes cryptographic
software written/developed by: Eric Young ([email protected]) and Tim Hudson
([email protected]).
Trademarks
ABB and Relion are registered trademarks of the ABB Group. All other brand or
product names mentioned in this document may be trademarks or registered
trademarks of their respective holders.
Warranty
Please inquire about the terms of warranty from your nearest ABB representative.

Disclaimer
The products are designed to be connected to and to communicate information and
data via a network interface. It is the user’s sole responsibility to provide and
continuously ensure a secure connection between the product and the user’s
network or any other network (as the case may be). The user shall establish and
maintain any appropriate measures (such as but not limited to the installation of
firewalls, application of authentication measures, encryption of data, installation of
anti-virus programs, etc) to protect the product, the network, its system and the
interface against any kind of security breaches, unauthorized access, interference,
intrusion, leakage and/or theft of data or information. ABB Ltd and its affiliates are
not liable for damages and/or losses related to such security breaches, any
unauthorized access, interference, intrusion, leakage and/or theft of data or
information.
The data, examples and diagrams in this manual are included solely for the concept
or product description and are not to be deemed as a statement of guaranteed
properties. All persons responsible for applying the equipment addressed in this
manual must satisfy themselves that each intended application is suitable and
acceptable, including that any applicable safety or other operational requirements
are complied with. In particular, any risks in applications where a system failure
and/or product failure would create a risk for harm to property or persons
(including but not limited to personal injuries or death) shall be the sole
responsibility of the person or entity applying the equipment, and those so
responsible are hereby requested to ensure that all measures are taken to exclude or
mitigate such risks.
This document has been carefully checked by ABB but deviations cannot be
completely ruled out. In case any errors are detected, the reader is kindly requested
to notify the manufacturer. Other than under explicit contractual commitments, in
no event shall ABB be responsible or liable for any loss or damage resulting from
the use of this manual or the application of the equipment.

Conformity
This product complies with the directive of the Council of the European
Communities on the approximation of the laws of the Member States relating to
electromagnetic compatibility (EMC Directive 2004/108/EC) and concerning
electrical equipment for use within specified voltage limits (Low-voltage directive
2006/95/EC). This conformity is the result of tests conducted by ABB in
accordance with the product standard EN 60255-26 for the EMC directive, and
with the product standards EN 60255-1 and EN 60255-27 for the low voltage
directive. The product is designed in accordance with the international standards of
the IEC 60255 series.

Table of contents
Section 1 Introduction.......................................................................5
This manual........................................................................................ 5
Intended audience.............................................................................. 5
Product documentation.......................................................................6
Product documentation set............................................................6
Related documents........................................................................7
Document symbols and conventions..................................................9
Symbols.........................................................................................9
Document conventions................................................................ 10
Section 2 Security in Substation Automation................................. 13
General security in Substation Automation...................................... 13
Section 3 Secure system setup......................................................15
Physical interfaces............................................................................15
Communication ports and services.................................................. 15
FTP access with TLS, FTPACCS.....................................................18
Encryption algorithms....................................................................... 18
Denial of service............................................................................... 19
Certificate handling...........................................................................19
Section 4 Local user account management................................... 21
Authorization.....................................................................................21
Predefined user roles....................................................................... 23
Password policies.............................................................................25
IED User management .................................................................... 26
Starting IED user management................................................... 26
General settings.......................................................................... 27
User profile management............................................................ 27
Adding new users...................................................................28
Adding users to new user roles.............................................. 31
Deleting existing users........................................................... 32
Changing password................................................................34
User role management................................................................ 36
Adding new users to user roles.............................................. 37
Deleting existing User from user roles................................... 37
Reusing user accounts...........................................................38
Writing user management settings to the IED............................. 39
Reading user management settings from the IED.......................39
Saving user management settings.............................................. 40
Table of contents
670 series 2.2 IEC 1
Cyber security deployment guideline

Section 5 Central Account Management........................................41
Introduction.......................................................................................41
Certificate management................................................................... 42
Creating IED certificates..............................................................42
Importing and writing certificates to an IED................................. 44
Reading certificates from an IED.................................................47
Certificate information on local HMI.............................................49
Invalid certificates ....................................................................... 52
Deleting certificates from an IED................................................. 52
Activation of Central Account Management..................................... 54
Manual configuration of Central Account Management...............59
Reading configuration from IED.................................................. 60
Deactivation of Central Account Management from PCM600..... 61
Deactivation of Central Account Management on local HMI....... 62
Authorization with Central Account Management enabled IED........63
Predefined user roles....................................................................... 66
Password policy settings for Central Account Management
enabled IED......................................................................................68
PCM600 access to Central Account Management enabled IED...... 68
Changing password.....................................................................69
Error messages........................................................................... 70
Trouble shooting Central Account Management.............................. 72
Section 6 User activity logging....................................................... 79
Activity logging protocol....................................................................79
Activity logging ACTIVLOG.............................................................. 79
Settings.............................................................................................79
Generic security application GSAL...................................................80
Security alarm SECALARM..............................................................80
Signals.........................................................................................81
Settings........................................................................................81
About Security events.......................................................................81
Event types.......................................................................................82
Section 7 Local HMI use................................................................ 85
Logging on........................................................................................85
Logging off........................................................................................88
Saving settings................................................................................. 88
Maintenance menu........................................................................... 89
Recovering password.................................................................. 89
Fallback access........................................................................... 91
Restore points............................................................................. 92
Section 8 Standard compliance statement.....................................95
Table of contents
2670 series 2.2 IEC
Cyber security deployment guideline

Applicable standards........................................................................ 95
IEEE1686 compliance...................................................................... 96
Section 9 Glossary....................................................................... 101
Table of contents
670 series 2.2 IEC 3
Cyber security deployment guideline

4

Section 1 Introduction
1.1 This manual
GUID-AB423A30-13C2-46AF-B7FE-A73BB425EB5F v18
The cyber security deployment guideline describes the process for handling cyber
security when communicating with the IED. Certification, Authorization with role
based access control, and product engineering for cyber security related events are
described and sorted by function. The guideline can be used as a technical
reference during the engineering phase, installation and commissioning phase, and
during normal service.
1.2 Intended audience
GUID-C9B8127F-5748-4BEA-9E4F-CC762FE28A3A v11
This guideline is intended for the system engineering, commissioning, operation
and maintenance personnel handling cyber security during the engineering,
installation and commissioning phases, and during normal service.
The personnel is expected to have general knowledge about topics related to cyber
security.
1MRK 511 399-UEN B Section 1
Introduction
670 series 2.2 IEC 5
Cyber security deployment guideline

1.3 Product documentation
1.3.1 Product documentation set GUID-3AA69EA6-F1D8-47C6-A8E6-562F29C67172 v15
IEC07000220-4-en.vsd
Planning & purchase
Engineering
Installing
Commissioning
Operation
Maintenance
Decommissioning
Deinstalling & disposal
Application manual
Operation manual
Installation manual
Engineering manual
Communication
protocol manual
Cyber security
deployment guideline
Technical manual
Commissioning manual
IEC07000220 V4 EN-US
Figure 1: The intended use of manuals throughout the product lifecycle
The engineering manual contains instructions on how to engineer the IEDs using
the various tools available within the PCM600 software. The manual provides
instructions on how to set up a PCM600 project and insert IEDs to the project
structure. The manual also recommends a sequence for the engineering of
protection and control functions, LHMI functions as well as communication
engineering for IEC 60870-5-103, IEC 61850, DNP3, LON and SPA.
The installation manual contains instructions on how to install the IED. The
manual provides procedures for mechanical and electrical installation. The chapters
are organized in the chronological order in which the IED should be installed.
The commissioning manual contains instructions on how to commission the IED.
The manual can also be used by system engineers and maintenance personnel for
assistance during the testing phase. The manual provides procedures for the
checking of external circuitry and energizing the IED, parameter setting and
configuration as well as verifying settings by secondary injection. The manual
Section 1 1MRK 511 399-UEN B
Introduction
6670 series 2.2 IEC
Cyber security deployment guideline

describes the process of testing an IED in a substation which is not in service. The
chapters are organized in the chronological order in which the IED should be
commissioned. The relevant procedures may be followed also during the service
and maintenance activities.
The operation manual contains instructions on how to operate the IED once it has
been commissioned. The manual provides instructions for the monitoring,
controlling and setting of the IED. The manual also describes how to identify
disturbances and how to view calculated and measured power grid data to
determine the cause of a fault.
The application manual contains application descriptions and setting guidelines
sorted per function. The manual can be used to find out when and for what purpose
a typical protection function can be used. The manual can also provide assistance
for calculating settings.
The technical manual contains operation principle descriptions, and lists function
blocks, logic diagrams, input and output signals, setting parameters and technical
data, sorted per function. The manual can be used as a technical reference during
the engineering phase, installation and commissioning phase, and during normal
service.
The communication protocol manual describes the communication protocols
supported by the IED. The manual concentrates on the vendor-specific
implementations.
The point list manual describes the outlook and properties of the data points
specific to the IED. The manual should be used in conjunction with the
corresponding communication protocol manual.
The cyber security deployment guideline describes the process for handling cyber
security when communicating with the IED. Certification, Authorization with role
based access control, and product engineering for cyber security related events are
described and sorted by function. The guideline can be used as a technical
reference during the engineering phase, installation and commissioning phase, and
during normal service.
1.3.2 Related documents GUID-94E8A5CA-BE1B-45AF-81E7-5A41D34EE112 v5
Documents related to REB670 Document numbers
Application manual 1MRK 505 370-UEN
Commissioning manual 1MRK 505 372-UEN
Product guide 1MRK 505 373-BEN
Technical manual 1MRK 505 371-UEN
Type test certificate 1MRK 505 373-TEN
1MRK 511 399-UEN B Section 1
Introduction
670 series 2.2 IEC 7
Cyber security deployment guideline

Documents related to REC670 Document numbers
Application manual 1MRK 511 401-UEN
Commissioning manual 1MRK 511 403-UEN
Product guide 1MRK 511 404-BEN
Technical manual 1MRK 511 402-UEN
Type test certificate 1MRK 511 404-TEN
Documents related to RED670 Document numbers
Application manual 1MRK 505 376-UEN
Commissioning manual 1MRK 505 378-UEN
Product guide 1MRK 505 379-BEN
Technical manual 1MRK 505 377-UEN
Type test certificate 1MRK 505 379-TEN
Documents related to REG670 Document numbers
Application manual 1MRK 502 071-UEN
Commissioning manual 1MRK 502 073-UEN
Product guide 1MRK 502 074-BEN
Technical manual 1MRK 502 072-UEN
Type test certificate 1MRK 502 074-TEN
Documents related to REL670 Document numbers
Application manual 1MRK 506 369-UEN
Commissioning manual 1MRK 506 371-UEN
Product guide 1MRK 506 372-BEN
Technical manual 1MRK 506 370-UEN
Type test certificate 1MRK 506 372-TEN
Documents related to RET670 Document numbers
Application manual 1MRK 504 163-UEN
Commissioning manual 1MRK 504 165-UEN
Product guide 1MRK 504 166-BEN
Technical manual 1MRK 504 164-UEN
Type test certificate 1MRK 504 166-TEN
Section 1 1MRK 511 399-UEN B
Introduction
8670 series 2.2 IEC
Cyber security deployment guideline

Documents related to RES670 Document numbers
Application manual 1MRK 511 407-UEN
Commissioning manual 1MRK 511 409-UEN
Product guide 1MRK 511 410-BEN
Technical manual 1MRK 511 408-UEN
Type test certificate 1MRK 511 410-TEN
Documents related to RER670 Document numbers
Application manual 1MRK 506 375-UEN
Commissioning manual 1MRK 506 377-UEN
Product guide 1MRK 506 378-BEN
Technical manual 1MRK 506 376-UEN
Type test certificate 1MRK 506 378-TEN
670 series manuals Document numbers
Operation manual 1MRK 500 127-UEN
Engineering manual 1MRK 511 398-UEN
Installation manual 1MRK 514 026-UEN
Communication protocol manual, DNP3 1MRK 511 391-UUS
Communication protocol manual, IEC
60870-5-103
1MRK 511 394-UEN
Communication protocol manual, IEC 61850
Edition 2
1MRK 511 393-UEN
Communication protocol manual, LON 1MRK 511 395-UEN
Communication protocol manual, SPA 1MRK 511 396-UEN
Point list manual, DNP3 1MRK 511 397-UUS
Accessories guide 1MRK 514 012-BEN
Cyber security deployment guideline 1MRK 511 399-UEN
Connection and Installation components 1MRK 513 003-BEN
Test system, COMBITEST 1MRK 512 001-BEN
Application guide, Communication set-up 1MRK 505 382-UEN
1.4 Document symbols and conventions
1.4.1 Symbols GUID-2945B229-DAB0-4F15-8A0E-B9CF0C2C7B15 v12
The electrical warning icon indicates the presence of a hazard
which could result in electrical shock.
1MRK 511 399-UEN B Section 1
Introduction
670 series 2.2 IEC 9
Cyber security deployment guideline

The warning icon indicates the presence of a hazard which could
result in personal injury.
The caution hot surface icon indicates important information or
warning about the temperature of product surfaces.
The caution icon indicates important information or warning related
to the concept discussed in the text. It might indicate the presence
of a hazard which could result in corruption of software or damage
to equipment or property.
The information icon alerts the reader of important facts and
conditions.
The tip icon indicates advice on, for example, how to design your
project or how to use a certain function.
Although warning hazards are related to personal injury, it is necessary to
understand that under certain operational conditions, operation of damaged
equipment may result in degraded process performance leading to personal injury
or death. It is important that the user fully complies with all warning and
cautionary notices.
1.4.2 Document conventions GUID-96DFAB1A-98FE-4B26-8E90-F7CEB14B1AB6 v6
•Abbreviations and acronyms in this manual are spelled out in the glossary. The
glossary also contains definitions of important terms.
• Push button navigation in the LHMI menu structure is presented by using the
push button icons.
For example, to navigate between the options, use and .
•HMI menu paths are presented in bold.
For example, select Main menu/Settings.
• LHMI messages are shown in Courier font.
For example, to save the changes in non-volatile memory, select Yes and
press .
• Parameter names are shown in italics.
For example, the function can be enabled and disabled with the Operation
setting.
•Each function block symbol shows the available input/output signal.
Section 1 1MRK 511 399-UEN B
Introduction
10 670 series 2.2 IEC
Cyber security deployment guideline

• the character ^ in front of an input/output signal name indicates that the
signal name may be customized using the PCM600 software.
• the character * after an input signal name indicates that the signal must
be connected to another function block in the application configuration
to achieve a valid application configuration.
•Logic diagrams describe the signal logic inside the function block and are
bordered by dashed lines.
• Signals in frames with a shaded area on their right hand side represent
setting parameter signals that are only settable via the PST, ECT or
LHMI.
• If an internal signal path cannot be drawn with a continuous line, the
suffix -int is added to the signal name to indicate where the signal starts
and continues.
• Signal paths that extend beyond the logic diagram and continue in
another diagram have the suffix ”-cont.”
Illustrations are used as an example and might show other products
than the one the manual describes. The example that is illustrated is
still valid.
1MRK 511 399-UEN B Section 1
Introduction
670 series 2.2 IEC 11
Cyber security deployment guideline

12

Section 2 Security in Substation Automation
2.1 General security in Substation Automation
GUID-D156D1EA-15EF-4700-B6E2-8A316A7C3288 v2
The electric power grid has evolved significantly over the past decade thanks to
many technological advancements and breakthroughs. As a result, the emerging
“smart grid” is quickly becoming a reality. At the heart of these intelligent
advancements are specialized IT systems – various control and automation
solutions such as substation automation systems. To provide end users with
comprehensive real-time information, enabling higher reliability and greater
control, automation systems have become ever more interconnected. To combat the
increased risks associated with these interconnections, we offer a wide range of
cyber security products and solutions for automation systems and critical
infrastructure.
The new generation of automation systems uses open standards such as IEC
60870-5-104, DNP 3.0 and IEC 61850 and commercial technologies, in particular
Ethernet- and TCP/IP-based communication protocols. They also enable
connectivity to external networks, such as office intranet systems and the Internet.
These changes in technology, including the adoption of open IT standards, have
brought huge benefits from an operational perspective, but they have also
introduced cyber security concerns previously known only to office or enterprise IT
systems.
To counter cyber security risks, open IT standards are equipped with cyber security
mechanisms. These mechanisms, developed in a large number of enterprise
environments, are proven technologies. They enable the design, development and
continual improvement of cyber security solutions specifically for control systems,
including substation automation applications.
ABB fully understands the importance of cyber security and its role in advancing
the security of substation automation systems. A customer investing in new ABB
technologies can rely on system solutions where reliability and security have the
highest priority.
At ABB, we are addressing cyber security requirements on a system level as well
as on a product level to support cyber security standards such as NERC-CIP, IEEE
1686 and BDEW Whitepaper. We support verified third-party security patches and
antivirus software to protect station computers from viruses and other types of
attacks. Cyber security can also be improved by preventing the unauthorized use of
removable media (such as USB memory sticks) in station computers. We have built
additional security mechanisms into our products. Those offer advanced account
management, secure communication, and detailed security audit trails. This makes
1MRK 511 399-UEN B Section 2
Security in Substation Automation
670 series 2.2 IEC 13
Cyber security deployment guideline

it easier for our customers to address NERC CIP requirements and maintain
compliance standards.
Remote Control Center
(Security Zone 3)
MaintenanceCenter (Security Zone 4)
IEC61850-8-1 Station Bus
MicroSCADA Pro SYS600C
Firewall/Router/VPN
Firewall /
Router /
VPN
Encrypted
communication
Encrypted
communication
Perimeter Protection
Security Zone 1
Control and Protection IED
Security Zone 2
Station LAN
Workstation
AntivirusMicroSCADA Pro SYS600
Antivirus
IEC12000189-3-en.ai
IEC12000189 V3 EN-US
Figure 2: System architecture for substation automation system
Section 2 1MRK 511 399-UEN B
Security in Substation Automation
14 670 series 2.2 IEC
Cyber security deployment guideline