Coordinated Reconnaissance Strategy for Digital Substations: Risks and Countermeasures

Digital substations are a critical component of modern power systems, integrating advanced communication protocols to ensure reliable and efficient grid operation. However, the coexistence of protection systems using the IEC 61850 standard and monitoring systems relying on the IEEE C37.118.2-2011 protocol introduces new cybersecurity vulnerabilities. This paper explores the risks posed by coordinated reconnaissance strategy, a key phase of cyberattacks during which attackers gather intelligence about the system to identify potential points of exploitation. This strategy targeting both protocols is analyzed through a cyber-physical testbed, focusing on passive and active reconnaissance scenarios. The paper proposes a multi-stage protection framework, encompassing deterrence, prevention, detection, and mitigation measures to counter reconnaissance threats. The results highlight the importance of adopting cybersecurity strategies to safeguard digital substations and ensure the stability of modern power grids.