Cybersecurity attacks increase in Indian wind sector: NITI Aayog

Home
Industry News
Cybersecurity attacks increase in Indian wind sector: NITI Aayog

Cybersecurity attacks increase in Indian wind sector: NITI Aayog

Industry News
Jul 22,24

A recent report by NITI Aayog highlights emerging cybersecurity concerns in the Indian wind sector, primarily due to the import of components from China by Wind Turbine Original Equipment Manufacturers (OEMs). The report advocates a multi-faceted strategy combining policy interventions, manufacturing support, and robust cybersecurity measures.

Given the growing influence of Chinese OEMs and the associated security risks, stakeholders are urged to collaboratively tackle these challenges to ensure India’s sustained growth in renewable energy and cybersecurity resilience. Addressing these concerns will help boost domestic manufacturing and software production, thereby enhancing the country's overall wind energy capacity.

Domestic manufacturing capacity for various wind components such as towers, blades, and gearboxes accounts for nearly 60% of the total cost of Wind Turbine Generators (WTG). The report identifies China as one of India’s biggest competitors in wind equipment exports, holding up to 61% of global wind-turbine assembly capacity in 2023, compared to India's 32%. Chinese wind industry growth is fuelled by government incentives and export tax rebates, which range from 6% to 16%.

To mitigate these risks, the Ministry of Power (MoP), through an order dated December 24, 2021, has designated specific laboratories for cybersecurity conformance testing of imported equipment. This includes standards for communication protocols and security conformance, emphasising testing protocols for buyers, including imports from specified countries. Previously, MoP had designated the Central Power Research Institute (CPRI) as the nodal agency for testing power system equipment for cybersecurity.

Designated laboratories are tasked with conducting essential cybersecurity tests during Factory Acceptance Tests (FAT) and Site Acceptance Tests (SAT) to secure the supply chain for wind energy projects. The initiative mandates regular cybersecurity audits for wind farms and proposes the installation of firewalls at each wind farm for controlled access to turbine components through VPN.

The Ministry of New and Renewable Energy has laid down guidelines for third-party audits of power system infrastructure cybersecurity, including solar and wind farms, grid-interactive inverters, OEM software, data centers, and communication devices, in consultation with MoP.

Despite significant progress, the National Institute of Wind Energy estimates that only 6% of assessed capacity has been realised, highlighting challenges. The report underscores the need to address issues in key component manufacturing, such as non-standard sizes, quality issues, and inconsistent demand, which hinder domestic manufacturing growth. Challenges also persist in sourcing materials like balsa wood, specialised resins, and steel plates with non-standard specifications. Import dependence for components such as tower flanges and castings poses sustainability risks to the industry.

Cybersecurity threats affecting wind turbines’ ability to exchange information via power plant controllers are emphasised, highlighting the critical need to develop Power Plant Controller (PPC) software. The report calls for scrutiny of PPC OEMs, especially those from neighboring countries, with potential suspensions for non-compliance.

Emphasising the potential risks of cyberattacks on wind turbines, the report advocates for robust security measures to safeguard national infrastructure. It acknowledges Indian government incentives like the Remission of Duties and Taxes on Export Products (RoDTEP) scheme while highlighting challenges such as exclusion from the Advance Authorisation scheme and increased manufacturing costs.

The report recommends mandatory certification of foreign software/hardware by Indian authorities (Central Electricity Authority, Ministry of Electronics and Information Technology, Standardization Testing and Quality Certification). It proposes budget allocations for cybersecurity infrastructure and mandates utilities appoint a Chief Information Security Officer (CISO) residing in India, accountable to an independent agency overseeing power sector cybersecurity.

Additionally, all Wind Sector OEMs are urged to locate or relocate their Data Centers and Research & Development Centers within India. Non-compliance may result in OEMs being barred from tender participation and supply within the country. The Ministry of New and Renewable Energy is tasked with setting timelines for this relocation.

(Source: Saur Energy)