• TESS Engineering and NTT Docomo Business are testing network-level threat detection and remote SIM blocking for solar-plant monitoring
  • The pilot must also establish how operators maintain visibility of a plant when its monitoring connection is deliberately cut

The fact

TESS Engineering and NTT Docomo Business said on 7 September that they are testing network-based security for communications used to monitor solar power plants remotely in Japan. TESS is using plants it owns and operates to assess the system under live operating conditions.

The pilot uses docomo business SIGN, an IoT network-as-a-service platform that monitors traffic, keeps communication logs, and can detect suspicious activity. When a threat is identified, the monitoring centre can be notified and an operator can remotely block communications for the affected SIM. The release describes control of the communications link, not a command to stop electricity generation.

TESS said it has previously seen cyberattacks on customer-provided communications lines that increased traffic volumes. Docomo said some monitoring devices cannot easily support strong security functions because of hardware or operating constraints. The companies are testing effectiveness and operational issues before considering a broader service covering communications lines and network equipment.

The assessment

Putting threat detection in the network gives TESS another way to protect monitoring equipment that cannot run strong security controls itself. The trade-off is that blocking a suspicious SIM may stop malicious traffic, but it can also remove the monitoring centre's view of that site until the connection is restored.

That makes the pilot an operational test as well as a security test. TESS needs to know who can block a connection, what information remains available during the interruption, and how staff confirm whether they are dealing with a communications problem or a problem at the plant itself.

For BTW readers, network-level blocking is useful only if the recovery process is equally clear. The pilot should show whether TESS can isolate a suspect connection and restore monitoring quickly enough to avoid leaving operators without visibility of the solar plant for longer than necessary.

What to watch

Watch for pilot results covering detected threats, unnecessary blocks and the time required to restore monitoring after a SIM is isolated. A commercial service should also define who is authorised to block and restore connections, and how plant operators maintain visibility while a communications link is under investigation.