To Prevent Cyber Attacks, Secure These 5 Technologies

The White House has flagged five top-priority energy technologies in its national plan to secure the modern power grid. The federal government aims to equip utilities, distributed energy resource (DER) aggregators, and operators with fresh guidelines and standards to minimize cyberattacks and digital vulnerabilities.

Can the right technology make digital energy resources harder to hack? Video used courtesy of Idaho National Laboratory

The White House cited popular technologies like rooftop solar panels and the control systems that manage them. Its priorities come as the Department of Energy (DOE) pushes a Cyber-Informed Engineering strategy to bring cybersecurity-by-design principles to the energy sector. These guidelines will help engineers, industrial control technicians, and manufacturers clear any risks early in the product development lifecycle to ensure a consequence-focused design with advanced controls to mitigate cyberattacks.

The DOE is working with other federal agencies to test “secure-by-design” and “secure-by-default” guidelines for digitally connected energy infrastructure. Ideally, secure-by-design products should be released with built-in features to minimize exploitable flaws, such as multi-factor authentication or logging and single sign-on, at no extra cost.

A Tesla vehicle hooked up to a charging station. Image used courtesy of Pexels/by Kindel Media

Battery Storage and EV Charging: Two Grid-Edge Technologies

Grid-edge technologies have risen dramatically in the past decade. These start at the meter interface and end at customer-owned equipment, software, and controls. Examples include rooftop solar installations, electric vehicle charging stations, energy storage systems, and virtual power plants (VPPs). In some regions of the U.S., distributed solar has reshaped the daily net load curve. The growing number of residential charging systems causes difficult-to-predict spikes in demand, adding complexity to grid management.

Integrating grid-edge equipment and distribution requires an interoperable end-to-end communications network for coordinating grid stability. Grid-integrated EV supply equipment should incorporate secure distributed energy controls—which are critical for managing loads and schedules via smart charging software.

For example, if all EVs in an apartment parking lot were to charge simultaneously at 19.2 kW each, the utility may be unable to quickly respond to loads in multiple megawatts. Grid reliability requires direct communications between distribution utilities and EV charging providers.

Combined charging system (CCS) communications, the predominant standard for non-Tesla EVs and charging networks in the U.S. and Canada, have several known vulnerabilities. Some CCS devices don’t provide mutual authentication, risking man-in-the-middle attacks that could expose billing data and other private details. If an attacker gains access through an unencrypted network, they could control the charger and store its data.

This profile shows the various security levels and subcomponents of a DER system. Image used courtesy of INL (Page 7) 

Distributed Control Systems

No universal standard exists for implementing cybersecurity mitigations in DERs nor for the distributed devices in an aggregator’s control system and DER fleet. Vulnerabilities often lie in communication among aggregators, DERs, and utilities.

A National Renewable Energy Laboratory report flagged several DER risks, including false data injection attacks that manipulate sensor data, man-in-the-middle attacks that intercept communications to disable equipment, and phishing or brute-force techniques to obtain credentials. Attackers could also overload a network through a denial-of-service attack.

As control functions become more distributed, the ability to manage roles and privileges grows more complex. Likewise, digitized monitoring and control means more data to process and store—thus, more targets for attackers.

The White House reiterated that secure-by-design DER management software can optimize the operation and coordination of hundreds of thousands of distributed assets, microgrids, VPPs, and other energy systems.

Inverter Controls and Power Conversion

Inverters and power conversion equipment are the foundation of all grid-connected DERs, including solar panels, wind turbines, and newer technologies like hydrogen electrolyzers.

Modern smart inverters include networking capabilities, unlocking a broader attack surface. Hackers could target the functions that manage voltage and frequency stability. For instance, instead of a drop in nominal frequency that increases the active power output from a PV system, an attacker could reduce the power output to create instability.

The DOE’s National Laboratories are building tools for engineers to manage this risk. Sandia National Laboratory’s SolarSnitch intrusion detection and mitigation system can help secure grid-edge PV communications in DER systems. This distributed solution protects smart inverter communications by processing data via deep packet inspection tools. It can also pinpoint cyber-physical events with custom machine-learning algorithms.

Building Energy Management

As IoT and smart devices spread to the building sector, energy management systems are incorporating advanced controls for behind-the-meter DERs like rooftop solar panels and EV chargers, alongside conventional lighting systems and heating, ventilation, and cooling.

These extra devices can make it difficult for transmission and distribution providers to meet demand in unforeseen circumstances. Consumers cranking up their air conditioning in a heatwave could cause transformers to run at peak levels in the middle of the day, hours before the forecasted peak load is set to begin. Meanwhile, a VPP provider could initiate charging for its energy storage devices, oblivious to the strained transmission and distribution system. Then, the utility may not know why customers switched from net generation via rooftop solar to a net load of 10 kW per battery. As a result, transformers reach their thermal limit, and interrupted power flow prompts outages.

This outcome could have been prevented with increased visibility and secure communications networks to transfer data between utilities, grid-edge devices, and intermediaries in real time.