IEC 61850 Security Guide: GOOSE, Sampled Values and MMS

In a digital substation, a protection relay will act on a GOOSE trip message from any device on the station bus that uses the right multicast address and dataset, because GOOSE carries no authentication unless IEC 62351-6 is applied. IEC 61850 replaced copper wiring between relays, merging units and bay controllers with Ethernet: MMS for client and server reporting and control, GOOSE for fast protection signalling, and Sampled Values (SV) for current and voltage measurements on the process bus. That brings interoperability and flexibility, and it also means a single compromised host or engineering laptop on the substation LAN can read status, send commands and spoof protection traffic. This guide covers the IEC 61850 attack surface, the security options for each message type, engineering file and access control, time synchronisation, monitoring and a rollout plan. It is for protection and control engineers, substation automation integrators and utility OT security teams; the part-by-part security standard is covered in the IEC 62351 Power System Communications Security Guide.

Key takeaways

Each message type needs a different control. MMS is TCP and can use TLS and role-based access control; GOOSE and SV are layer 2 multicast with millisecond timing, so they need message authentication codes with group keys, or isolation and monitoring where that is not yet possible.
Industroyer proved the MMS path is a target. MITRE ATT&CK documents its IEC 61850 component scanning port 102, enumerating logical nodes with MMS GetNameList and searching for circuit breaker and switch (CSW) nodes.
The engineering chain is the most powerful access. Whoever can edit the substation configuration (SCD) and load IED configurations (CID) can change protection behaviour; treat engineering tools, files and workstations as privileged.
Segmentation inside the substation matters. Separate station bus, process bus, engineering access and the WAN conduit, keep GOOSE and SV from leaving the substation unless routable profiles with security are used.
Monitoring is a protection-grade requirement. GOOSE and SV are highly predictable, so new publishers, unexpected state changes and MMS control writes stand out clearly if you collect them.

How an IEC 61850 substation communicates

IEC 61850 is the IEC TC 57 series "Communication networks and systems for power utility automation". The 2026 series pack published by the IEC on 14 October 2026 lists more than 50 documents. The parts that define the traffic security teams must protect are:

Message or file	Defined in	Transport	Purpose	Typical timing
MMS	IEC 61850-8-1 (Ed 2.1, 2020)	TCP port 102	SCADA and gateway reads, reports, control (select-before-operate), file transfer, settings	Seconds
GOOSE	IEC 61850-8-1	Ethernet multicast (EtherType 0x88B8), VLAN tagged	Trips, interlocks, breaker failure, status between IEDs	A few milliseconds for trips
Sampled Values	IEC 61850-9-2 (2011 + AMD1:2020)	Ethernet multicast (EtherType 0x88BA)	Current and voltage samples from merging units to protection	Continuous, thousands of frames per second
Routable GOOSE and SV	IEC TR 61850-90-5 (2012)	IP (UDP)	Wide-area protection and synchrophasors (IEEE C37.118 data)	Tens of milliseconds
Time synchronisation	IEC/IEEE 61850-9-3 (PTP power profile)	Ethernet	Sub-microsecond time for SV and event records	Continuous
SCL configuration files	IEC 61850-6 (2009 + AMD1:2018 + AMD2:2024)	Files	System and IED configuration (SSD, SCD, ICD, CID and others)	Engineering time

The station bus connects IEDs, bay controllers, the substation gateway and HMI; the process bus connects merging units and switchgear interfaces to protection IEDs. IEC TR 61850-90-4:2020 gives network engineering guidance for both but states that security is the subject of IEC 62351 and IEC 62443, so network design and security design have to be brought together deliberately.

Attack paths and what attackers have done

Attack path	Example	Consequence	ATT&CK for ICS v20
Discovery over MMS	Industroyer's IEC 61850 component scanned port 102 and sent MMS GetNameList to find CSW logical nodes	Map of every breaker and switch the attacker can operate	T0846.001 Port Scan, T0888 Remote System Information Discovery
Reading process state	Industroyer sent stVal reads to learn current positions	Attacker knows the state before acting	T0801 Monitor Process State
Unauthorised MMS control	Operate commands to circuit breaker controls from a compromised host	Loss of supply	T1692.001 Unauthorized Message: Command Message
GOOSE spoofing	Forged GOOSE with a higher state number and trip value	False trips or blocked interlocks	T1692.001, T0830 Adversary-in-the-Middle
SV manipulation	Injected or altered samples on the process bus	Protection mis-operation	T1692.002 Unauthorized Message: Reporting Message
Protection relay denial of service	Industroyer's SIPROTEC module used CVE-2015-5374 to make relays unresponsive until manually rebooted	Loss of protection	T0814 Denial of Service, T0837 Loss of Protection
Configuration change	Modified CID or settings loaded from an engineering laptop	Changed protection behaviour that persists	T0836 Modify Parameter, T0864 Transient Cyber Asset

Industroyer (MITRE S0604) was used in the December 2016 attack on Ukraine's grid (C0025). Its successor Industroyer2 (S1072), found by ESET and CERT-UA in April 2022 before it could run, implemented only IEC 60870-5-104, not IEC 61850, and was scheduled to execute against high-voltage substations on 8 April 2022 alongside the CaddyWiper wiper. ESET attributes it to Sandworm with high confidence. The lesson is that substation attacks use whichever protocol the target runs, and that the IT foothold and wipers came first.

Securing MMS: TLS, RBAC and gateway control

TLS under IEC 62351-3: the 2023 edition profiles TLS 1.2 and TLS 1.3 with mandatory cipher suites and CRL and OCSP revocation. Secure MMS commonly uses TCP 3782. Enable it first between the substation gateway and IEDs that support it, using certificates from an OT PKI.
Application-level security under IEC 62351-4: protects MMS end to end through intermediate entities, useful where a gateway or proxy terminates TLS.
Role-based access control: IEC 62351-8:2026 defines roles and access tokens; IEC PAS 61850-90-19:2026 applies them to IEC 61850 and binds permissions to specific data objects through the SCL description. In practice: viewer roles for monitoring, operator roles for control, engineer roles for settings and file transfer, and a security administrator role, instead of one shared IED password per access level.
Limit MMS clients: only the gateway, station HMI and engineering workstation should open MMS associations to IEDs. Firewall or switch ACL rules on TCP 102 and 3782 enforce this, and a new MMS client is an alert.
Select-before-operate and interlocks: keep control models that require select-before-operate with enhanced security where IEDs support it, and keep station-level interlocking logic independent of SCADA commands.

Securing GOOSE and Sampled Values

GOOSE and SV have no session, are multicast to many subscribers and must arrive within milliseconds, so TLS does not apply. IEC 62351-6:2020 defines security for IEC 61850-8-1 and 9-2 traffic, and IEC 62351-9:2023 extends the IETF group key protocol GDOI to carry the security parameters for GOOSE, SV and PTP.

Approach	What it protects	Requirements	Trade-offs
Isolation only	Nothing in the message; relies on physical and network separation	Dedicated VLANs or physically separate process bus, no routing, port security	Any device that reaches the VLAN can publish
Isolation plus monitoring	Detects spoofing after the fact	Passive taps or mirror ports, GOOSE and SV aware monitoring	Detection, not prevention; trip may already have happened
IEC 62351-6 message authentication	Authenticity and integrity of each frame	IED and merging unit support, GDOI key distribution centre, key rollover procedures	Added processing per frame; key server availability becomes a protection dependency
Routable GOOSE and SV (TR 61850-90-5) with security	Wide-area traffic between substations	Group keys, IP multicast design, WAN security	Traffic leaves the substation, so authentication is not optional

How to decide: authenticate GOOSE and SV on new bays where IEDs, merging units and the protection scheme's timing budget support it, and where you can run a redundant key distribution service. On existing bays, isolate and monitor. Never route GOOSE or SV out of the substation without authentication. Protection engineering must sign off any change, with latency measured on the actual hardware.

Group keys are shared NHI secrets: every subscriber to a GOOSE control block holds the same group key, distributed by the key distribution centre. Plan key rollover intervals, behaviour when a subscriber misses a rollover, and protection of the KDC itself, which becomes as critical as the IEDs. See the Machine Identity, PKI and Certificate Lifecycle Guide.

Engineering files, tools and access

SCL files describe the whole substation: the SCD file holds every IED, dataset, GOOSE control block and communication parameter, and CID files configure individual IEDs. Anyone who can change them can change protection.

Version control and integrity: keep SCD and CID files in a controlled repository with change history and approval; compare the configuration loaded on each IED against the approved file after every change.
Signed files: IEC 62351-11 provides security for XML documents; where your tools support it, use signed configuration exchanges.
Engineering workstation: relay setting tools and system configurators should run on dedicated, hardened workstations with named accounts and MFA through an intermediate system. See the Engineering Workstation Security Guide.
Front-panel and local access: IED front ports and local HMIs often bypass network controls. Restrict physical access and use per-device credentials held in a vault until RBAC is deployed. See the OT and ICS Identity and Access Guide.
Integrator access: commissioning engineers from vendors and integrators need time-bound named accounts and supervised sessions. See the OT Third-Party and Integrator Access Guide.
GOOSE simulation mode: IEC 61850-8-1 Amendment 1 covers simulation of GOOSE telegrams for testing. Make sure test sets and IEDs in test mode are controlled, and alert on simulation flags outside test windows.

Network design and time synchronisation

Zones: process bus, station bus, engineering access and the WAN conduit as separate zones with deny-by-default rules at the substation gateway. See the OT Network Segmentation Guide.
Switch hardening: port security on edge ports, disabled unused ports, VLAN assignment per traffic type, management over SSH and SNMPv3 only, and configuration backups.
Multicast containment: confine GOOSE and SV VLANs to the switches that need them; never trunk them to the WAN or to IT networks.
Redundancy is not security: seamless redundancy protocols keep frames flowing if a link fails; they also duplicate any spoofed frame.
Protect PTP: SV and event records depend on precise time from the IEC/IEEE 61850-9-3 PTP profile. A rogue grandmaster can shift time; restrict which ports may act as master, monitor grandmaster changes, and use the GDOI-based PTP security that IEC 62351-9:2023 adds where devices support it.

Implementation steps

Inventory: list IEDs, merging units, switches, gateways and clocks per substation with firmware and IEC 62351 capabilities, and extract GOOSE publishers and subscribers from the SCD file. See the OT Asset Visibility Guide.
Monitor first: deploy passive monitoring on station and process bus and baseline MMS clients, GOOSE publishers and SV streams.
Segment and restrict MMS: enforce zones and limit TCP 102 to known clients.
Control engineering: version-controlled SCL, dedicated engineering workstations, named and time-bound access.
Enable MMS TLS and RBAC: pilot on one bay with the gateway and two IEDs, then extend by IED model.
Pilot GOOSE and SV authentication: on a new bay in a test lab first, measuring latency and testing KDC loss and key rollover, then on site with protection engineering sign-off.
Standardise: make the validated design the template for new substations and refurbishments.

Testing and rollback: use factory and site acceptance tests that include security functions, and keep the previous approved SCD and CID files so an IED can be restored within the outage. Never enable a security feature on in-service protection without a tested way back.

Small distribution operator vs transmission operator: a distribution operator with conventional substations and a few IEC 61850 bays should concentrate on segmentation, MMS client restriction, engineering control and monitoring. A transmission operator building digital substations with process bus should specify IEC 62351-6 and 62351-9 support, RBAC and PTP security in every new design.

Detection and measurement

New GOOSE publishers or control blocks: any GOOSE frame from a source MAC or control block not in the SCD file.
State anomalies: unexpected jumps in GOOSE state numbers, trip values with no corresponding fault in SV data, and simulation flags outside test windows.
MMS activity: new MMS clients, GetNameList enumeration from hosts other than the gateway or HMI (the Industroyer pattern), operate commands outside switching programmes, and file transfers or settings changes.
SV anomalies: duplicate streams, sample counter discontinuities and measurement values inconsistent with neighbouring merging units.
Time: PTP grandmaster changes and offset jumps.
Device health: IEC 62351-7 network and system management objects for IED security state. See the OT Network Security Monitoring Guide.

Metrics: substations with passive monitoring of station and process bus; IEDs reachable over MMS only from approved clients; bays with authenticated GOOSE and SV or a recorded compensating control; IEDs whose loaded configuration matches the approved SCL; IEDs still using shared passwords.

Framework mapping

Control	NIST SP 800-53 Rev. 5	NIST CSF 2.0	Threat addressed
MMS TLS and IEC 62351-4	SC-8, SC-23	PR.DS-02	T0830, T1692.001
GOOSE and SV message authentication	SC-8, SI-7	PR.DS-02	T1692.001, T1692.002
RBAC (IEC 62351-8, PAS 61850-90-19)	AC-3, AC-6	PR.AA-05	T0836 Modify Parameter
Group key and certificate management	SC-12, SC-17, IA-5	PR.AA-01	T0830
Zones and MMS client restriction	SC-7	PR.IR-01	T0846.001, T0888
SCL version control and verification	CM-3, SI-7	PR.PS-01	T0836, T0864
Passive monitoring	SI-4, AU-2	DE.CM-01	Detection of the above

For the programme and security level framework around these controls, see the IEC 62443 Guide; for North American compliance, the NERC CIP Guide.

Common failure patterns

Flat substation LAN: gateway, HMI, engineering laptops, IEDs and merging units on one network, so any compromised host can send GOOSE and MMS.
GOOSE VLANs trunked everywhere: multicast protection traffic visible on switches and links that do not need it, including uplinks.
Shared IED passwords: the same access-level password on every relay, known to staff and contractors over many years.
Uncontrolled SCL files: copies of the SCD file on laptops and email, with no way to know which version is loaded on which IED.
Security features switched off after commissioning problems: TLS or authentication disabled to fix an interoperability issue and never re-enabled.
No monitoring of the process bus: the most predictable traffic in the plant, and the least watched.

Lessons from incidents

No live NHI Mgmt Group breach page covers a substation attack, so the lessons here come from MITRE ATT&CK and ESET's published analysis. Industroyer in 2016 showed that an attacker with a foothold on the substation network can discover and operate breakers through standard MMS services, and can disable protection relays through a known vulnerability. Industroyer2 in 2022 showed the same group reusing code against a different protocol, with wipers to slow recovery. Both argue for the same controls: restrict who can speak MMS to IEDs, patch or isolate relays with known vulnerabilities, monitor for enumeration and control commands, and prepare to restore IED configurations from trusted SCL files.

Practitioner checklist

Extract GOOSE publishers, subscribers and MMS clients from each SCD file and compare them with observed traffic.
Separate process bus, station bus, engineering and WAN zones, and restrict TCP 102 to approved clients.
Keep GOOSE and SV VLANs local and never route them unauthenticated.
Enable MMS TLS under IEC 62351-3 with OT PKI certificates on IEDs that support it.
Replace shared IED passwords with IEC 62351-8 roles where supported, and vault per-device credentials where not.
Put SCL files under version control and verify loaded IED configurations after every change.
Pilot IEC 62351-6 GOOSE and SV authentication with GDOI on a new bay, with latency and key rollover tests.
Protect PTP by restricting grandmaster-capable ports and monitoring grandmaster changes.
Deploy passive monitoring for new publishers, MMS enumeration and control commands.

IEC 61850 Substation Communications Security Guide: Securing GOOSE, Sampled Values and MMS