Abstract. International hacker organizations have made more effort to research on the penetration attack technologies for smart grid automation system, planed and implemented attacks to international power grid systems, and caused accidents. The author of this paper discusses the security challenges of cyber-physical system in substations from three perspectives: security threats, issues of security system in power grid and security requirements in substations, and introduces the integrated security supervision technical solution. It shows that to make substations more security, two part of missions must be accomplished by the integrated security supervision system. On the substation side, the system collects operation information, system log, and mirrored communication packets of devices, analyses devices and systems behaviour, assesses the local security situation. On the main station side, the system gathers security information from substations, distributes the security policy to substations, monitors and analyses the overall security situation with aggregate data. The solution has been deployed in several projects and achieved remarkable results.