---

Abstract: As cyber security in the substation automation system and the smart grid has been recognized critical, a plethora of documents related to cyber security have been published. This paper intends to sort out all security approaches and derive the high-level security strategies which can cover all possible specific security measures applied for actual implementation. All security measures ultimately come under three security strategies: network separation, communication message security, and monitoring. Network separation is involved in physical separation and logical network separation, which are located in the front line of defense. As the last line of defense, communication message security is involved in data authentication, data integrity, and optionally data confidentiality. Monitoring should be an integral part of security strategies for detection and reporting of attacks. The intrusion detection system (IDS) is a main tool to realize security monitoring. To design the domain-specific IDS can be a viable security solution to enhance security capabilities of the current substation automation system. The concept of network management can be expanded to enhance security monitoring capability as well as integrated operation of IT and OT systems. Considering the fact that the substation automation system is the main building block of the smart grid and IEC 61850 protocols will be an essential part of data modeling and communication in the smart grid, the security strategies analyzed in the paper can provide reasonable validity to address security issues of the smart grid.

---