Safety
Protective Relay
A device that detects electrical faults and trips circuit breakers to protect equipment and people.
Critical criticalityLevel 1
What it does
Continuously evaluates current/voltage against protection settings and issues trip signals.
Typically locatedSubstations, generation plants, large industrial electrical rooms.
At a glance
PurdueLevel 1
CategorySafety
Protocolsgoose, iec-61850, dnp3, modbus-rtu
Talks toBreakers, Other relays via GOOSE, Station gateway
Common vendorsSEL, ABB (Relion 615/670), GE Vernova, Siemens (SIPROTEC 5, engineered with DIGSI 5)
Why should I care?
Protective Relay sits at Level 1. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Settings accessible with weak local authentication
- Aging firmware
- Undocumented setting groups
If it is compromised
- Equipment damage or outages from incorrect protection behaviour
What to monitor
- Setting group switches
- Trip and event records
- Configuration file changes
How to defend it
- Baseline and periodically verify relay settings
- Restrict engineering access paths
- Physical security
Hunting
Hunt ideas for this component
Related