Open / standardized
IEC 61850
A substation automation standard defining a data model plus several communication profiles: MMS for client/server, GOOSE for fast peer-to-peer status, and Sampled Values for measurements.
102/TCP for MMS; GOOSE and SV are Layer 2Ethernet (MMS over TCP, GOOSE / SV Layer 2)Encryption: Optional
How it works
Devices publish a standardised logical-node data model. Station clients read/write via MMS; protection devices publish GOOSE multicast messages to peers with sub-cycle timing requirements.
Communication patternStation client ↔ IED via MMS; IED → IED via GOOSE multicast.
Fact sheet
TransportEthernet (MMS over TCP, GOOSE / SV Layer 2)
Ports102/TCP for MMS; GOOSE and SV are Layer 2
AuthenticationOptional
PurdueLevel 2 – Level 0
EnvironmentsDigital substations
DevicesIED, Protective relay, Merging unit, Station gateway
IndustriesElectric Power
Why should I care?
Understanding IEC 61850 is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read data objects
- Control with select-before-operate
- Report/log subscription
- GOOSE publish/subscribe
- SCD configuration
Security concerns
- GOOSE is Layer 2 multicast with no built-in cryptographic protection in common deployments
- Station bus flat design lets any connected port see protection traffic
- Configuration (SCD/CID) files describe the whole substation and are sensitive
What normal looks like
- Stable GOOSE publishers and stNum/sqNum progression
- MMS clients limited to station HMI and gateway
What deserves attention
- Unexpected GOOSE publisher MAC
- Abnormal stNum increments
- New MMS client on the station bus
Hunting ideas
- rogue-master-controller
- new-device-control-zone
- unauthorized-firmware-change
Defensive controls
- Port security and switch hardening on the station bus
- IEC 62351 where supported
- Passive monitoring of GOOSE publisher inventory
Related ATT&CK for ICS techniques
T0855T0836
Sources & further reading