Globally, renewables make up the majority of new generating resources[i]. This is partly driven by city, state, country and utility commitments to decrease carbon emissions. The increasing penetration – especially of Distributed Energy Resources (DERs) like solar and wind means the attack surface of our energy infrastructure is growing, and greater utility management is required to maintain grid reliability.

Wind farm vulnerabilities

Wind farms are cyber-physical systems consisting of overlapping networks of power distribution controls and data flows. Their design includes various potential access points, both physical and digital. More obviously, a wind farm includes multiple turbines, Remote Terminal Units (RTUs), collector feeders, switchgear, and substation equipment that we can see. Digital/cyber access points include the not so obvious technologies running in the background, like Supervisory Control & Data Acquisition (SCADA) for gathering real-time data and other embedded software and IIoT technologies.

Wind farms are also remotely connected to various entities that have communications access. The wind farm owner’s control center, OEMs, O&M providers, and the local utility, to name a few. These entities may utilize different levels of security mechanisms making for a more complex cyber-physical security landscape.

Physical protection

The physical security of wind farms is complicated by the fact there are often located in remote areas and access to even one turbine could lead to damage or disabling of an entire wind plant. As an example, as part of a penetration test that a windfarm owner agreed to, US researchers broke into one turbine and quickly connected their inexpensive equipment to a network cable. Within minutes, they were able to remotely stop not only the individual wind turbine they’d broken into but all the others connected to it on the same network.

The relatively easy physical access led to the researchers planting malicious software to infect the windfarm’s computers and falsify the signals being sent from the turbines to confuse control center operators.

As we move away from traditional sources of energy to more renewable generation, we’ve got to make sure new energy sources are as well protected or better protected than the ones we replace.

Cyber protection

Energy companies are automating more and more to reduce their operational risks and control costs.  Many wind farms today include internet-connected tools and sensors to automate and improve plant performance and allow wind operators to obtain critical operational data faster and more reliably. As energy companies have increasingly become dependent on internet connectivity to improve efficiency, the number of possible entry points has expanded.

The consequences of cyber-attacks within wind farms go beyond the loss of production and revenue. Serious safety concerns exist in terms of potential injury to wind farm staff or even to bystanders if the equipment is damaged. Reputational damage, cost to fix equipment and regulatory fines are other possible results from a cyber breach. All these negative issues can impact not only the wind farm owner but also all the stakeholders across the value chain, including OEMs, supply chain vendors, utilities, O&M providers and financing entities.

PSC’s unique qualifications for wind farm cyber-physical security

PSC’s global specialists understand the electric utility and energy markets businesses, and the technical challenges utilities face in securing their digital assets. We combine our in-house IT security expertise with our deep electricity utility OT domain experience to help our clients reduce and manage their risk.

When it comes to connecting wind farms to the grid, our team of engineers have a proven track record and are widely recognized in the renewable industry for being knowledgeable, reliable and highly experienced. We are a trusted advisor to many leading renewable energy developers, offering extensive and innovative electrical engineering consultancy services through broad experience and in-depth technical knowledge.

Our experts can help assess your vulnerabilities and threats and implement solutions that improve cybersecurity while complying with all regulatory standards. We’ll assist in developing business cases and recommendations, manage cybersecurity risk by developing and implementing workable cybersecurity strategies, evaluate and procure new cybersecurity solutions, and implement and support cybersecurity projects. We are vendor-neutral and independent; our sole focus is providing recommendations and services that best meet our clients’ individual needs.

Contact us to find out how we can help protect your assets today.

[i] https://ieefa.org/resources/renewables-continue-break-records-despite-covid-19-impacts