Cybersentry; Overview - GE G30 Instruction Manual

8.2 CYBERSENTRY

8.2CYBERSENTRY
CyberSentry Embedded Security is a software option that provides advanced security services through the following:
• An Authentication, Authorization, Accounting (AAA) Remote Authentication Dial-In User Service (RADIUS) client that
is centrally managed, enables user attribution, provides accounting of all user activities, and uses secure standards-
based strong cryptography for authentication and credential protection.
• A Role-Based Access Control (RBAC) system that provides a permission model that allows access to UR device oper-
ations and configurations based on specific roles and individual user accounts configured on the AAA server (that is,
Administrator, Supervisor, Engineer, Operator, Observer).
• Security event reporting through the Syslog protocol for supporting Security Information Event Management (SIEM)
systems for centralized cybersecurity monitoring.
• Strong encryption of all access and configuration network messages between the EnerVista software and UR devices
using the Secure Shell (SSH) protocol, the Advanced Encryption Standard (AES), and 128-bit keys in Galois Counter
Mode (GCM) as specified in the U.S. National Security Agency Suite B extension for SSH and approved by the
National Institute of Standards and Technology (NIST) FIPS-140-2 standards for cryptographic systems.
Example: Administrative functions can be segmented away from common operator functions, or engineering type access,
all of which are defined by separate roles, as shown in the following figure, so that access of UR devices by multiple per-
sonnel within a substation is allowed. Permission for each role are outlined in the table later in this section.
There are two types of authentication supported by CyberSentry that can be used to access the UR device:
• Local Authentication (local UR device authenticates)
• Remote Authentication (RADIUS server authenticates)
The EnerVista software allows access to functionality that is determined by the user role, which comes either from the local
UR device or RADIUS server.
The EnerVista software has a local authentication option on the login screen for accessing the UR device. When the "Local"
button is selected, the UR uses its local authentication database and not the RADIUS server to authenticate the user. In this
8
case, it uses its built-in roles (Administrator, Engineer, Supervisor, Observer, Operator) as login names and the associated
passwords are stored on the UR device. As such, when using the local accounts, access is not user-attributable.
8-4
Figure 8–1: CYBERSENTRY USER ROLES
G30 Generator Protection System
8 SECURITY

8.2.1 OVERVIEW

GE Multilin