A Protocol Is Not a Security Posture
Power systems run on a family of communication protocols. Modbus connects meters, inverters, and controllers; DNP3 carries utility SCADA; IEC 61850 runs inside substations; and BACnet runs building automation. Most were designed decades ago for closed networks where every device on the wire was trusted. Security came later, one protocol at a time, through secured versions of each and a separate standards series, IEC 62351, written to add it to the utility protocols. None of it was designed for the network as a whole.
Modbus is the oldest and most widely deployed of them, and it shows the pattern most clearly. Modicon developed it in 1979 for its programmable logic controllers (Automation World, 2004), and newer standards still build on it. The SunSpec Alliance built SunSpec Modbus on it in 2009 for solar inverters and other distributed energy resources, and IEEE 1547-2018 names it as one of the interfaces those resources may use to connect to the grid (SunSpec Alliance, 2019). Modbus is simple and open, which is why our gateways offer it too. However, it has no way to identify who sent a request or whether they are authorized.
That is a matter of scope, not a flaw: Modbus moves register values between devices that already trust each other. Deciding which devices and people get to talk at all is a different job, and a monitoring network needs something else to do it.
What Modbus Leaves Out
A Modbus TCP request carries a function code, a register address, and a value. It carries no username, password, or certificate, and the protocol does not encrypt it. Any device that can reach a meter’s port 502 can read every register it exposes, and on equipment that accepts writes, it can change setpoints or operate outputs.
That gap is harmless on an isolated network with a fence around it. It becomes a risk as soon as the monitoring data has to reach someone or something outside the electrical room.
What Secure Protocols Add
Over the past two decades, Modbus, BACnet, and DNP3 have all gained secured versions. DNP3 has Secure Authentication, BACnet has Secure Connect, which runs over TLS 1.3 with a certificate for each device (ASHRAE, 2019), and Modbus has a TLS-based Modbus/TCP Security specification. OPC UA, a newer protocol, was designed to sign and encrypt its messages with application certificates from the start. Where both ends support them, they are worth turning on.
However, two gaps remain:
- Legacy equipment. Equipment stays in service for decades and rarely gets a firmware update that adds a secured protocol. Most of what is installed still has the original weakness: no authentication and no encryption.
- Exposure before authentication. A secured protocol checks certificates only after a connection has reached the device, and only for its own traffic. Anyone with network access can still probe every other service it runs, find an insecure port someone forgot to close, or flood it until it fails. Finding those vulnerabilities is automated and cheap, and AI assistance makes it faster.
The network needs to decide and enforce who can reach a device at all. There, one identity system covers every protocol, instead of each protocol keeping its own keys and certificates.
How Monitoring Networks Are Usually Secured
Most power monitoring networks rely on some combination of four arrangements:
- A flat plant network. Meters, controllers, and workstations share one segment, and anything on it can reach everything else.
- A firewall port forward. A port on the building firewall is opened to a meter or a data logger so a vendor or a cloud service can reach it.
- A vendor’s remote-access tunnel. A device opens an outbound connection to the vendor’s cloud. No port is opened, but whoever holds the vendor’s account reaches the plant network through it, often without the site’s IT team knowing.
- A VPN concentrator. Remote users and vendors connect to a VPN appliance and land on the plant network, often with the whole subnet within reach.
All four trust a location or a shared account. Being on the right subnet, coming from the right address, or holding a VPN login or vendor account grants access to whatever sits behind it. A compromised laptop on that subnet, an exposed port found by a scan, or a vendor account shared among technicians inherits that trust. Sites usually answer with more scrutiny of the vendors: security questionnaires, requirements such as IEC 62443-2-4 for service providers, and audits. That raises confidence in each vendor, but access still rests on trusting them rather than on checking each connection.
A VPN also says nothing about what is already inside: a backdoor in installed software, or a rogue device someone plugged in on site, has the same reach as everything else on the subnet. NIST’s Guide to Operational Technology (OT) Security (SP 800-82 Rev. 3, 2023) recommends segmenting OT networks and controlling every path into them for this reason.
Identity Instead of Location
Zero trust is the name for the alternative. NIST’s Zero Trust Architecture (SP 800-207, 2020) describes moving defenses “from static, network-based perimeters to focus on users, assets, and resources,” and granting no implicit trust to anything based on its network location. Each connection is checked against who is making it and what that identity may reach.
For a monitoring network, that means each gateway and each person proves its identity before any traffic flows, and access follows a rule written for that identity rather than for an address range.
What a Certificate-Based Overlay Network Is
A certificate-based overlay network applies that model in software, on top of whatever network a site already has:
- A certificate authority signs every member. Each gateway, server, and engineer’s computer receives a certificate that binds its key to a name, an address on the overlay, and the groups it belongs to. A certificate expires on a date set when it is signed. Revoking one member’s certificate cuts off that member alone, with no shared password or VPN account to change for everyone else.
- Peers authenticate each other. Before two members exchange a packet, each checks that the other’s certificate was signed by the authority. A device without a valid certificate cannot join at all, wherever it is plugged in.
- Traffic is encrypted end to end. Members connect directly to each other where they can. Discovery servers help them find one another and relay traffic through networks that block direct paths, without being able to read it.
- Nothing on site listens on the open internet. Site members connect outward and traverse NAT, so no port is opened on a site’s firewall.
- Access is granted by group and denied by default. Each member’s firewall drops every inbound connection unless a rule names the sender’s group. Being on the overlay grants nothing on its own.
The overlay does not replace the plant network or its protocols. It replaces the port forward and the VPN as the way in.
Where Modbus Fits
In the zones-and-conduits model of the ISA/IEC 62443 series, devices that must trust each other share a zone, and every path between zones is a conduit with its own controls. Modbus belongs inside a zone, between a gateway and the meters and controllers beside it. The overlay is the conduit: the only path from outside the zone to the gateway, and one that admits a named identity, not an address.
How Our Platform Is Secured
The Energy Quotient platform runs on these principles:
- Edge first. Recording, analysis, and AI can all run on site, on the gateway and an edge AI computer, including on air-gapped networks, so raw waveforms can stay there.
- Fiber to every sensor. Each EQ Wave™ connects to its gateway over optical fiber, which leaves no electrical path from the measured conductors to the network.
- A certificate-based overlay. Our gateways, our engineers’ computers, and those of customer engineers who need direct access are members of a Nebula overlay, the open-source network developed at Slack, under our certificate authority. Each customer with direct access has its own group, so one customer’s people and devices cannot reach another’s. Our administrative group goes only on computers our named engineers use, never on unattended infrastructure. Two discovery servers in different regions keep the overlay reachable if one fails.
- The overlay ends at the gateway. It routes nothing into the plant network, so a member reaches the gateway and nothing behind it.
- You control the gateway’s reach. It connects only to the equipment the engagement calls for, such as meters to poll or devices to control, and your firewall can hold it to those devices and ports. Blocking its outbound connections turns remote access off, and the platform is designed to keep running air-gapped.
- Every connection has a name. Each one is tied to a person’s certificate, so we can show you who can reach each gateway and revoke one person without affecting anyone else.
- Single sign-on for people. Where a site allows remote access to a gateway’s web interface, the gateway opens an outbound tunnel to an identity-aware proxy. Each person signs in with their own organization’s account, never a shared one, and the groups they belong to decide which gateways they reach.
The electrical record adds a layer no network control provides. A rogue device connected inside a zone never crosses the conduit, but it draws current, and the waveform shows it. Power as a Security Sensor explains how.