Digital & Monitoring
Cybersecurity for Digital Switchgear and Power SCADA
Once relays, meters and controllers are networked, the switchgear lineup is part of the facility's attack surface. This article covers the concepts that matter for protecting power distribution systems, from network segmentation and access control to device hardening, logging and the standards that define what secure IEDs and secure architectures look like.
8 min read · Updated 2026-09 · Apex Power Distribution Engineering
Why switchgear is now an attack surface
A protective relay is a computer that can open a breaker. A gateway that converts Modbus to a cloud protocol is a computer with a network path into the electrical room. Each is a legitimate improvement, and each moves the boundary of what an attacker, or an untrained employee with the wrong access, can reach.
The protocols that run power systems were designed for isolated networks. Modbus, serial or TCP, has no authentication: any device that can reach the port can read and write registers. Secure profiles exist for DNP3 and IEC 61850 but are not universally deployed or supported by every device. Security therefore has to come from the architecture around the devices, not from the devices alone.
Zones, conduits and the Purdue model
The foundation is segmentation. The Purdue reference model separates enterprise IT from plant operations in levels, with an industrial demilitarized zone (DMZ) between them so that no traffic passes directly from the business network to control devices. Data leaving the control network is staged in the DMZ and pulled from there; nothing on the enterprise side initiates a connection to a relay or PLC.
ISA/IEC 62443 formalizes this with zones and conduits. A zone is a group of assets with common security requirements, such as the relays and controllers of one switchgear lineup; a conduit is the controlled path between zones, typically a firewall with explicit rules. Each zone gets a target security level based on the consequence of compromise, and the controls on the zone and its conduits are chosen to meet that level. The framework also assigns responsibilities to asset owner, integrator and product supplier.
Access control and secure remote access
Every person and system that can change a setting or operate a device should be identified individually and given only the permissions the role requires. Role-based access separates viewing from control and control from configuration, and it retires the shared engineering password many installations still depend on.
Remote access is where many incidents start. Connections terminate at a hardened jump host in the DMZ rather than reaching the control network directly, use multi-factor authentication, are time-limited and approved for a purpose, and are logged with session recording where practical. Vendor access follows the same path under the owner's control.
Hardening the devices
Relays, meters, gateways and controllers ship with default passwords, open services and enabled ports that should be closed before energization. Hardening means changing every default credential, disabling unused Ethernet and serial ports and protocols (web servers, FTP and Telnet where not needed), applying the manufacturer's hardening guide, and controlling physical access to front-panel USB and configuration ports.
IEEE 1686 defines the cybersecurity capabilities an IED should provide: individual user accounts and password controls, role-based permissions, an audit trail of configuration changes and access attempts, the ability to disable unused ports and services, and authenticated firmware updates. Requiring a completed IEEE 1686 table of compliance gives procurement a concrete way to compare relays and controllers rather than accepting a general claim that a product is secure.
Monitoring, backups and patching
Devices should send authentication failures, configuration changes and control operations to a central log, typically through syslog to a security information and event management (SIEM) system, with time synchronized to the same source the relays use for event records. An alarm on an unexpected setting change matters operationally as much as for security.
Recovery depends on backups. Relay setting files, PLC programs, gateway configurations and HMI projects belong in a controlled repository with version history, restored periodically to prove the backup works. Patching power equipment is slower than IT: firmware updates are tested on a bench or in an outage window, checked against the protection settings, and applied under change control. A documented decision not to patch, with compensating controls, is acceptable; an unknown firmware version is not.
Secure gateway architecture and protocol realities
Since legacy devices cannot be made secure themselves, the practical pattern is to place them behind a secure gateway. The gateway terminates the insecure protocol on an isolated segment, authenticates and encrypts communication toward SCADA or the cloud (for example MQTT over TLS or OPC UA with certificates), and enforces read-only access where control is not required. Data for analytics platforms can pass through a one-way path so that nothing can be sent back toward the equipment.
None of this replaces the physical and procedural controls that already govern switchgear. Locked rooms, interlocks, lockout/tagout and approved switching procedures remain the primary barriers, and protective functions remain governed by approved protection, control and safety procedures.
Key takeaways
- Networked relays, gateways and remote operation make switchgear part of the attack surface, and Modbus and similar protocols provide no protection of their own.
- Segment using the Purdue model with an industrial DMZ; define zones, conduits and target security levels per ISA/IEC 62443.
- Individual accounts, least privilege, MFA and jump-host remote access remove the most common paths in.
- Harden devices (defaults, ports, services) and require IEEE 1686 capabilities so IED security is measurable.
- Log to a SIEM, back up and test restores of settings and programs, and manage firmware under change control.