Cyber Security for IEC 61850 Networks: Protecting the UK’s Smart Grid
When a ransomware attack forced a major UK energy supplier to shut down its customer-facing IT systems in 2023, it was a reminder that the energy sector is now a frontline target. But while headlines focus on billing systems and corporate networks, a quieter transformation has been taking place inside the substations themselves. Ethernet cables have replaced copper pilot wires, intelligent electronic devices (IEDs) now talk to each other directly, and the IEC 61850 standard has become the lingua franca of substation automation. That connectivity brings enormous operational benefits — and a new attack surface that UK utilities can no longer afford to ignore.
Why IEC 61850 Networks Are a Cyber Security Concern
IEC 61850 was designed for interoperability and speed, not for security. Its Ethernet-based architecture means that anyone who can reach the substation LAN can potentially see, capture, or inject traffic. The National Cyber Security Centre (NCSC) has repeatedly warned that operational technology (OT) environments face rising threats from state-aligned actors and criminal groups, and its guidance on OT security makes clear that traditional IT assumptions do not hold in a substation.
The shift from serial to Ethernet-based communications
Legacy substations used hardwired point-to-point connections and serial protocols such as IEC 60870-5-101. To interfere with those signals, an attacker needed physical access to a specific cable pair. IEC 61850 replaces this with switched Ethernet, multicast messaging, and routable IP traffic. The upside is flexibility and reduced cabling; the downside is that a single compromised port can expose an entire bay, and potentially an entire substation, to manipulation.
GOOSE and SV: speed vs. security trade-offs
GOOSE (Generic Object Oriented Substation Event) messages and Sampled Values (SV) are the workhorses of IEC 61850. GOOSE trips a breaker in milliseconds; SV carries digitised current and voltage data from merging units. Both are Layer 2 multicast frames with no built-in authentication or encryption in the base standard. That design choice was deliberate — cryptographic overhead could break the sub-4 ms performance that protection schemes depend on. It also means GOOSE frames can be spoofed or replayed by an attacker with network access, potentially causing false trips or, worse, preventing a genuine trip from being acted upon.
Case study: potential impact on UK transmission networks
Consider a hypothetical but plausible scenario on a UK transmission substation running IEC 61850. An attacker with access to a single unmanaged switch port injects forged GOOSE messages claiming a fault on a 400 kV feeder. If the protection IEDs accept the messages, circuit breakers open, disconnecting generation or load. Cascading outages across a transmission network are possible if multiple substations are targeted simultaneously. This is precisely the kind of scenario the Energy Networks Association (ENA) has been working to address through its cyber security programme for the UK’s electricity networks.
Key Threats to Substation Automation Systems
Threats to IEC 61850 networks fall into a handful of categories, and UK-specific risk is shaped by the presence of sophisticated state actors and an increasingly connected grid.
Unauthorized access to IEDs and gateways
Many IEDs still ship with default credentials, and engineering access is often protected by little more than a shared password. Once inside, an attacker can change protection settings, disable logging, or use the IED as a pivot point into the wider substation network. Gateways that translate between IEC 61850 and legacy protocols such as DNP3 are particularly attractive targets because they bridge security zones.
Man-in-the-middle and GOOSE spoofing
Because GOOSE and SV traffic is unauthenticated, a man-in-the-middle positioned on the substation LAN can intercept, modify, or replay messages. Tools demonstrated at security conferences have shown that GOOSE spoofing is achievable with commodity hardware and open-source software. The practical barrier is access — which is why physical and logical segmentation matters so much.
Malware and ransomware targeting UK utilities
Triton (also known as TRISIS) was the wake-up call for the OT world: malware specifically designed to manipulate safety instrumented systems. While it targeted petrochemical plant in the Middle East, the techniques are transferable. Ransomware groups have increasingly targeted UK utilities, and the convergence of IT and OT networks means an initial compromise in an office environment can, if segmentation is poor, reach the substation.
Standards and Regulations for UK Cyber Security
The UK has a reasonably mature framework for OT cyber security, and IEC 61850 deployments sit squarely within it.
IEC 62351: security for IEC 61850
IEC 62351 is the security companion to IEC 61850. It defines authentication for GOOSE and SV (via digital signatures in IEC 62351-6), TLS-based protection for MMS client-server traffic, and role-based access control for IEDs. Adoption has been slow because of performance concerns and interoperability gaps between vendors, but most major manufacturers — Siemens, ABB, GE, and Schneider Electric among them — now support at least parts of the standard in their latest product lines.
UK NIS Regulations and Ofgem oversight
The Network and Information Systems (NIS) Regulations 2018 brought electricity operators into scope as operators of essential services. Ofgem acts as the competent authority for the electricity subsector, issuing guidance and, where necessary, enforcement. In practice, this means UK transmission and distribution network operators must demonstrate appropriate and proportionate security measures for their substation automation systems.
NCSC Cyber Assessment Framework (CAF) for OT
The NCSC’s Cyber Assessment Framework provides the structure most UK utilities use to evidence NIS compliance. Its 14 principles cover governance, risk management, asset management, and resilience. For IEC 61850 networks, the CAF’s emphasis on network segmentation, monitoring, and supply chain security maps directly onto practical engineering decisions.
Practical Security Measures for IEC 61850 Networks
Defence in depth remains the guiding principle. No single control will protect a substation, but layered measures dramatically raise the cost of a successful attack.
Network segmentation and VLANs
Separate protection, control, and supervisory traffic into distinct VLANs. Use unmanaged switches sparingly, and where possible deploy managed switches with port security, MAC filtering, and storm control. A typical layered approach includes:
- Process bus VLAN for SV traffic only
- Station bus VLAN for GOOSE and MMS
- Supervisory VLAN for SCADA and historian traffic
- Management VLAN for engineering access, reachable only via jump hosts
Role of firewalls and intrusion detection systems
Industrial firewalls from Cisco, Siemens (Scalance), and Belden/Hirschmann can enforce deep-packet inspection on IEC 61850 traffic. Intrusion detection systems tuned for GOOSE and MMS — such as those from Nozomi Networks, Dragos, and Claroty — can flag anomalous publish rates, unexpected source MAC addresses, or malformed frames. The Centre for Protection of National Infrastructure (CPNI) has published guidance recommending continuous monitoring of OT networks rather than relying on periodic audits alone.
Secure remote access and authentication
Remote engineering access should always traverse a hardened jump host with multi-factor authentication, never a direct VPN into the substation LAN. Where IEC 62351-8 role-based access control is supported, enforce it. Centralise authentication where possible, and log every session for later forensic review.
Implementing Security in Digital Substations
The move to digital substations — where merging units digitise analogue signals at the primary plant and process bus replaces copper — amplifies both the benefits and the risks of IEC 61850.
Case study: National Grid’s digital substation
National Grid’s digital substation trials, conducted with partners including GE and Siemens, demonstrated process bus and non-conventional instrument transformers in live UK transmission environments. The trials highlighted that while digital architectures reduce cabling and improve data visibility, they also demand rigorous cyber security engineering from day one — particularly around time synchronisation (IEEE 1588) and process bus integrity.
Balancing security with operational performance
Adding encryption or signature verification to GOOSE can add latency. The pragmatic approach is to apply strong controls at zone boundaries — firewalls, unidirectional gateways — and reserve cryptographic protection for the traffic that can tolerate it, such as MMS and engineering access. This is where IEC 62351-6 signature schemes with hardware acceleration are starting to become viable.
Training and awareness for UK utility staff
Most incidents still begin with a person: a phishing email, a USB stick, a misconfigured firewall rule. Utility staff need OT-specific training that goes beyond generic IT awareness. The ENA and NCSC both run exercises and guidance programmes aimed at UK network operators, and we strongly recommend participation.
Future Trends and Our Recommendations
AI and machine learning for threat detection
Behavioural baselining of GOOSE and MMS traffic is already showing promise. Machine learning models can learn normal publish patterns per IED and flag deviations within seconds — far faster than human analysts.
Quantum computing and post-quantum cryptography
Harvest-now-decrypt-later attacks are a real concern for long-lived grid infrastructure. NIST’s post-quantum algorithms will eventually need to be embedded in IED firmware, and vendors are beginning to roadmap this. Utilities should factor crypto-agility into procurement now.
Collaboration across UK energy sector
No single utility can solve this alone. The ENA’s cyber security work, NCSC guidance, and Ofgem oversight create a framework, but day-to-day information sharing between operators is what turns frameworks into resilience. We recommend prioritising investment in network monitoring, segmentation, and staff training before chasing newer, shinier technologies.
Securing IEC 61850 networks is not a project with an end date. It is an ongoing discipline that blends standards like IEC 62351, technologies from vendors such as Siemens, ABB, and Cisco, and UK-specific collaboration through the NCSC, ENA, and Ofgem. The smart grid will only be as trustworthy as the weakest GOOSE frame on the wire — and that is a responsibility shared across the entire sector.
FAQ
Is IEC 61850 inherently insecure?
Not inherently, but its base specification prioritises speed and interoperability over security. IEC 62351 exists to add authentication and encryption, and most modern IEDs support at least part of it. The real risk comes from poor network design and weak access controls rather than the protocol itself.
Does the UK NIS Regulations apply to my substation?
If you operate electricity transmission or distribution infrastructure designated as an essential service, yes. Ofgem is the competent authority for the electricity subsector and can require evidence of appropriate security measures, often assessed against the NCSC Cyber Assessment Framework.
Can GOOSE messages be encrypted?
IEC 62351-6 specifies digital signatures for GOOSE rather than full encryption, because encryption would add unacceptable latency to protection trips. In practice, most utilities rely on network segmentation and monitoring to protect GOOSE traffic instead.
What is the biggest cyber security gap in UK substations today?
In our view, it is visibility. Many operators still lack continuous monitoring of IEC 61850 traffic, meaning intrusions or misconfigurations can go undetected for weeks. Closing that gap with OT-aware intrusion detection is often the highest-return investment.
How does National Grid’s digital substation work inform security practice?
The trials showed that process bus and digital instrument transformers deliver real operational benefits, but they also concentrate data flows and create new dependencies on time synchronisation and network integrity. Security engineering must be designed in from the start, not bolted on afterwards.
