8-4 C30 Controller System GE Multilin8.2 CYBERSENTRY 8 SECURITY88.2CYBERSENTRY 8.2.1 OVERVIEWCyberSentry Embedded Security is a software option that provides advanced security services through the following:• An Authentication, Authorization, Accounting (AAA) Remote Authentication Dial-In User Service (RADIUS) client thatis centrally managed, enables user attribution, provides accounting of all user activities, and uses secure standards-based strong cryptography for authentication and credential protection.• A Role-Based Access Control (RBAC) system that provides a permission model that allows access to UR device oper-ations and configurations based on specific roles and individual user accounts configured on the AAA server (that is,Administrator, Supervisor, Engineer, Operator, Observer).• Security event reporting through the Syslog protocol for supporting Security Information Event Management (SIEM)systems for centralized cybersecurity monitoring.• Strong encryption of all access and configuration network messages between the EnerVista software and UR devicesusing the Secure Shell (SSH) protocol, the Advanced Encryption Standard (AES), and 128-bit keys in Galois CounterMode (GCM) as specified in the U.S. National Security Agency Suite B extension for SSH and approved by theNational Institute of Standards and Technology (NIST) FIPS-140-2 standards for cryptographic systems.Example: Administrative functions can be segmented away from common operator functions, or engineering type access,all of which are defined by separate roles, as shown in the following figure, so that access of UR devices by multiple per-sonnel within a substation is allowed. Permission for each role are outlined in the table later in this section.Figure 8–1: CYBERSENTRY USER ROLESThere are two types of authentication supported by CyberSentry that can be used to access the UR device:• Local Authentication (local UR device authenticates)• Remote Authentication (RADIUS server authenticates)The EnerVista software allows access to functionality that is determined by the user role, which comes either from the localUR device or RADIUS server.The EnerVista software has a local authentication option on the login screen for accessing the UR device. When the "Local"button is selected, the UR uses its local authentication database and not the RADIUS server to authenticate the user. In thiscase, it uses its built-in roles (Administrator, Engineer, Supervisor, Observer, Operator) as login names and the associatedpasswords are stored on the UR device. As such, when using the local accounts, access is not user-attributable.
