Strengthen the Comprehensive Protection Technology Management

With the rapid development and wide application of computer and network technology, power companies are faced with increasing information security risks in all aspects of production, operation and management.

Compared with the “Regulations on the Protection of Secondary Power Systems” issued by the State Electricity Regulatory Commission in 2004 (“Order No. 5”), this “Regulation” puts forward the requirements for strengthening the protection of power monitoring systems for power companies. New requirements? What is the guiding significance for the power company to adjust and improve its security protection strategy? How do power companies further rectify security breaches on the basis of the original? In response to the above problems, the reporter went into Huaneng Group Corporation and Zhejiang Energy Group Corporation to understand.

Strengthen the comprehensive protection technology management and attach importance to the “Safety Protection Plan of Power Plant Monitoring System” attached to the 14th Order, adding “comprehensive protection” to the original 'safety zone, network-specific, horizontal isolation, and vertical authentication'; at the same time, the original thermal power On the basis of hydropower safety protection, safety requirements for monitoring systems for new forms of energy such as nuclear power, wind power, photovoltaic power generation, natural gas, and biomass have been added,” Huaneng Group Guo Sen said in an interview with reporters, from the perspective of power generation companies, The new regulations changed the original problem of using only isolated methods to solve the security problems of power plant monitoring systems. Companies are required to implement multiple layers of information security protection through security reinforcement, boundary protection, access control, security auditing, data backup, and intrusion detection. In addition, the new energy forms that are increasingly being taken seriously by the state and the electric power enterprise groups have been incorporated into the safety protection regulations, making the “Regulations” more complete.

"We believe that the focus of the enhanced security protection for the power monitoring system is to resist attacks and violations of power monitoring systems by hackers, viruses, and malicious code, and to ensure the safe and stable operation of the power system. In addition to building a border security fence, we must pay special attention to internal In addition to relying on safety technology, we must pay more attention to safety management, and the two must not be neglected,” Zengeng Qinganghua told reporters.

The "Regulations" make it clear that the security protection of the power monitoring system is an integral part of the power production safety management system. It integrates the safety protection work of the power monitoring system and information submission into the daily safety production management system, and integrates the safety protection evaluation of the power monitoring system into the power system security. The evaluation system will surely further promote the enterprises to thoroughly implement and implement the security protection work of the power monitoring system.

The reporter actively learned that Huaneng Group, as the drafter of some of the provisions of the regulations, actively cooperated with the National Energy Administration to select its own power plant to carry out pilot projects, aiming at different types of equipment and actual operation conditions. Rectification to ensure that the provisions are enforceable and operational after release. On the other hand, according to regulatory requirements, it is also necessary to revise the relevant management standards for the safety protection of power monitoring systems in a timely manner so as to meet the management needs.

“The power monitoring system is relatively complicated and huge, and the relevant organizations for security protection are also relatively large. It is necessary to integrate government supervision departments, enterprises, and individuals, and to exert collective strength to do a good job of protecting the power monitoring system.” Guo Sen told reporters It shows that, first of all, it is necessary to clarify the responsibilities of the government's supervisory departments and enterprises, establish a safety-protected organization that meets actual needs, and formulate an effective management system; secondly, establish a technical standard system for the protection of power monitoring systems. Ultimately, the issue of security protection depends on technological progress. With a technical standard system, it can provide a reference for the protection of power systems across the country; once again, it must strengthen technical supervision and management. The real end-point of security protection is still in the enterprise, and it is necessary to adopt technical supervision means to discover problems and solve problems, so as to continuously improve the security protection capabilities of enterprises; finally, it is necessary to strengthen training and continuously improve the technical capabilities of personnel within the system.

Zhejiang Energy Group, through its science and technology project, innovated and piloted the Lanxi Power Plant in Zhenneng, developed and applied a set of security protection and monitoring system for DCS. The system establishes a set of DCS input and output data security management and auditing, mobile media authentication and control security auditing system, monitors the DCS system's operation behavior, ensures the DCS engineer station and operator station's identity authentication, and ensures the DCS system. The virus control of the input and output files and isolation ensure the safety management of the core equipment in the production control area. The security system is the highlight of management innovation of Zhejiang Energy Group. It has been approved by relevant departments and it is believed that it can be applied and promoted in the industry.

It is understood that in recent years, Zhe Neng Group has adopted external professionalism to carry out risk assessment work on production control areas in Lanxi and Wenzhou power plants, and has received good results.

“In the previous evaluation of network and information security, we discovered that power generation companies still need to further strengthen account number and password management, security patches, and system service enhancements. We consider combining risk assessment and rating to compensate for these deficiencies. Qin Ganghua explained to reporters that Zhejiang Neng Group will set up a technical safety protection technology standard system for enterprise power monitoring systems, implement the technical management requirements of the "Regulations," and formulate an emergency plan for the protection of power monitoring systems.

At the same time, organize and carry out training on the protection and protection of power monitoring systems. On the one hand, in-depth study of the requirements of the "Regulations", on the other hand, study and master the related technologies of security protection and improve the level of technical capabilities.