Greater than 270 substations operated by state-run Energy Grid Company of India Ltd, all commissioned earlier than official cybersecurity tips have been launched in late 2021, stay with out next-generation firewalls, paperwork reviewed by The Indian Categorical present.
The estimated price of putting in superior firewalls—geared up with intrusion detection and prevention techniques—throughout 273 substations is estimated at round Rs 119 crore. Energy Grid has instructed the federal government this expenditure is “tough to accommodate” below its operations and upkeep (O&M) finances as a result of “very stringent” regulatory limits, the paperwork reveal.
The matter can be taken up at a gathering of the Nationwide Energy Committee (NPC) in Shillong on Might 16, the place members will talk about a mechanism to ebook or recuperate the price of these installations. The assembly will even deliberate on a broader roadmap for implementing firewalls throughout the nationwide transmission infrastructure, as per the agenda.
The absence of next-generation firewalls at substations poses cybersecurity dangers to India’s important infrastructure, particularly in opposition to the backdrop of simmering tensions with Pakistan and the evolving capabilities of state and non-state actors. Subsequent-generation firewalls combine intrusion detection and prevention techniques to observe, detect, and block malicious visitors in actual time, providing superior risk safety past conventional firewalls.
In an April 2024 assembly, Energy Grid instructed high officers that no firewall is put in in over 270 of its current substations that have been commissioned earlier than the Central Electrical energy Authority (CEA) issued cybersecurity tips in October 2021.
Then, in a December 2024 assembly, the NPC’s member-secretary famous that “firewall should not put in at current substations of POWERGRID and a number of the different Transmission Service Suppliers (TSPs) to make sure perimeter safety,” in accordance with paperwork.
A Energy Grid consultant additional said that there was “no firewall at POWERGRID stations for any sort of information communication in direction of RLDC (Regional Load Dispatch Centre),” and that such installations have been additionally essential to safe the Inter-State Transmission System (ISTS) communication community.
Story continues beneath this advert
Extra just lately, in April this 12 months, the corporate instructed the CEA that bearing the Rs 119 crore price for firewall installations below current O&M norms might negatively impression its financials. “The expenditure of approx. Rs 119 Crs for firewalls below O&M bills for 273 substations is tough to accommodate. It is going to additional impression the business efficiency measures,” Energy Grid stated in accordance with paperwork.
Within the April 2024 assembly, India’s apex grid operator had famous that assaults on the ability sector “have grown and are additionally frequent”. “The techniques with out ample safety gadgets on the periphery are liable to be compromised and a attainable lateral motion can’t be dominated out which can have an effect on a bigger system,” Grid India had stated.
Nonetheless, whereas firewalls are extensively adopted as an entry management technique in opposition to hackers, they don’t assure cybersecurity.
“Situations of firewalls being mis-configured and even when the configuration of firewalls are appropriate, it has vulnerabilities as a result of they don’t seem to be in a position to detect insider assaults and connections from the trusted websites. Therefore, options based mostly solely on firewalls might be insufficient,” CEA famous in paperwork.
Story continues beneath this advert
In September 2024, Union Energy Minister Manohar Lal inaugurated the Laptop Safety Incident Response Staff for the ability sector (CSIRT-Energy), which is tasked with detecting threats, enabling fast response, and bettering sector-wide resilience. It additionally promotes greatest practices, conducts coaching, and facilitates collaboration to strengthen total cybersecurity preparedness.
On the inauguration, the minister stated, “The threats we face at the moment are not like these of the previous. Cyberattacks have emerged as a severe and rising concern, able to inflicting important disruptions with far-reaching penalties. The ability sector, being on the coronary heart of our nationwide infrastructure, is a main goal for such assaults.”
Earlier, in April 2022, then Union Energy Minister RK Singh had stated, “Two makes an attempt by Chinese language hackers have been made to focus on electrical energy distribution centres close to Ladakh however weren’t profitable… We’ve already strengthened our defence system to counter such cyber assaults”.