Study Overview
OMICRON analyzed data from more than 100 substations, power plants, and control centers worldwide using its passive intrusion detection system (IDS) StationGuard. Deployments spanning from 2018 to the present revealed that critical security and operational issues are often detected within minutes of connecting the sensor to the network.
Key Technical Vulnerabilities
- Outdated firmware on PAC devices, including unpatched CVE‑2015‑5374 and similar GOOSE/MMS flaws.
- Undocumented external TCP/IP connections, sometimes exceeding 50 persistent links per substation.
- Unsecured services such as NetBIOS file sharing, IPv6 services, and privileged license‑management daemons.
- Flat network architectures that allow unrestricted communication between hundreds of devices, often extending to office IT networks.
- Blind‑spot assets (IP cameras, printers, automation devices) missing from manual inventories.
Organizational Challenges
- Lack of formal processes for patch management and firmware updates.
- Insufficient asset‑tracking procedures, leading to incomplete inventories.
- Poor coordination between OT and IT teams, resulting in ambiguous responsibility for security controls.
Operational Weaknesses
- VLAN misconfigurations that undermine network segmentation.
- Time‑synchronization errors affecting coordinated protection functions.
- Network redundancy problems that reduce resilience and increase outage risk.
Why Network‑Level Detection Is Essential
Many OT devices lack standard operating systems, making endpoint detection impossible. Standards such as NIST CSF, IEC 62443, and ISO 27000 series require detection capabilities at the network layer. StationGuard fulfills this need by using mirror ports or Ethernet TAPs to monitor traffic without disrupting operations.
StationGuard Solution Highlights
- Passive and active asset discovery using IEC 61850‑6 SCD files and MMS protocol queries.
- Real‑time signature‑based detection of known threats.
- Allow‑listing that flags subtle deviations from expected protocol behavior.
- Rapid visibility: most critical issues identified within the first 30 minutes of deployment.
Recommendations for Utilities
- Implement continuous network‑level monitoring with passive IDS solutions.
- Establish automated asset‑inventory processes that combine passive data with active MMS queries.
- Enforce strict network segmentation and eliminate flat‑network designs.
- Adopt a disciplined patch‑management program targeting known OT firmware vulnerabilities.
- Integrate OT security practices with existing IT governance frameworks (NIST, IEC 62443, ISO 27000).