Cybersecurity Audit of a High-Voltage Substation Network
An electricity transmission network operator entrusts us with auditing 14 high-voltage substations, their remote control network, and two control centers. Data collected under real operating conditions, with no power outage and no loss of control availability.
[ Context ]
The client operates a regional electricity transmission network: 14 high-voltage substations at 63 and 225 kV, remotely controlled from two control centers, with a backup center able to take over control. The substations were built and renovated over roughly thirty years. As a result, they house equipment from very different generations: recent digital protection relays over IEC 61850, older IEDs connected over IEC 60870-5-104, bay computers, local engineering workstations, and operating links between substations. Several vendors coexist on the same site.
Operations rely on a small control team and on maintenance teams who travel from one substation to another. Vendors intervene remotely for protection settings and firmware updates. The client, identified as an essential entity under the NIS2 Directive, had to present an assessment of the security of its installations and an associated action plan. No technical analysis of the remote control network had been carried out since it was commissioned.
The Challenge
The operator knew what it was controlling, not what was actually connected. The single-line diagrams and automation plans were up to date, but no document described the remote control network as it actually operated in 2025: addressing, actual flows between substations and control centers, equipment added over successive renovations, remote access set up during commissioning. Security relied on the assumed isolation of the operating network, an assumption no one had verified since the arrival of vendor remote maintenance access.
The regulatory context added a deadline, but the initial request came from operations: knowing who can reach what, from where, on installations that can't be shut down.
Incomplete and outdated equipment inventory
Vendor remote maintenance access left permanently open
Flat remote control network across the fourteen substations
Our Approach
Grid control could not be degraded at any point: no power outage, no loss of remote control, no loss of telesignaling to the control centers. The method was built around this constraint. All data collection on live installations was gathered without soliciting field equipment, and the only active tests were run offline, in a test lab and on a backup substation. Operations was involved from start to finish.
Review of single-line diagrams, automation plans, operating procedures, and remote maintenance contracts. Definition, with the operator, of the intervention rules: substations selected per campaign, access windows, authorized connection points for data collection, work logging, and a procedure for immediately halting work at the request of the operations officer.
Four on-site campaigns covering the 14 substations and the two control centers. Data collected via mirror port and passive TAP on the remote control links and bay networks: traffic captured in listen-only mode, with nothing sent to the equipment. OT asset inventory: PLCs, HMIs, supervision stations, network equipment, remote access, supplemented by a survey of IEDs and protection relays with firmware version and role within the substation.
Reconstruction of the actual flows between substations, control centers, and external parties from the captures. Zone and conduit segmentation under IEC 62443: bay protection and control zone, substation zone, remote control conduit, control center zone, remote access zone. Matrix of legitimate flows, proposed target security level per zone, and the gap against the observed situation.
Offline analysis, on configuration copies, of switches, routers, protocol gateways, IEDs, and engineering workstations. Review of accounts and permissions, authentication policies, active services, removable media, and update chains. Comparison of deployed firmware against vendor security advisories. Active checks confined to an offline backup substation and a mock-up in the test lab.
Drafting of the audit report: each finding is tied to a risk level, a remediation effort, and an owner. Remediation plan prioritized across three horizons: immediate, 6 months, 18 months. Two-part presentation: a technical session with the operations and maintenance teams, a summary for management, focused on decisions and the NIS2 trajectory.
[ Results ]
On-site verified inventory of the 14 substations: around 40 IEDs and relays, each tied to its zone.
Remote control flow mapping and IEC 62443 zone and conduit segmentation, with a matrix of legitimate flows.
Eleven remote maintenance access points identified, four unknown to the teams; four removed, the rest controlled and logged.
47 findings and a three-stage action plan; now the basis of the operator's NIS2 file.
Our starting requirement was simple: not a single second of control downtime. It was honored across all four campaigns, and the data was collected under real operating conditions, with our operations officers present at every intervention. We came out of it with a map we maintain ourselves and a work plan management approved without hesitation.
Discover other industrial cybersecurity missions carried out by Leviotec, in France and internationally
.svg)
.svg)