In its national plan to fortify the modern power grid, the White House has identified five crucial energy technologies. This initiative aims to provide utilities, distributed energy resource (DER) aggregators, and operators with updated guidelines and standards designed to reduce cyberattacks and digital vulnerabilities.
The administration has emphasized technologies such as rooftop solar panels and their associated control systems. These priorities align with the Department of Energy’s (DOE) Cyber-Informed Engineering strategy, which advocates for embedding cybersecurity measures into the design of energy systems. This approach encourages engineers, control technicians, and manufacturers to address potential risks early in the development process, incorporating advanced controls to prevent cyber threats.
The DOE is collaborating with federal agencies to test guidelines for “secure-by-design” and “secure-by-default” approaches in digitally connected energy infrastructure. These products are expected to include built-in security features like multi-factor authentication and logging at no additional cost, thus minimizing exploitable vulnerabilities.
Grid-Edge Technologies: Battery Storage and EV Charging
Over the past decade, grid-edge technologies such as rooftop solar systems, electric vehicle (EV) charging stations, and energy storage solutions have become increasingly prominent. These technologies, which interface directly with customer-owned equipment, have introduced complexities in grid management. For instance, residential solar installations and EV chargers can lead to unpredictable spikes in demand, challenging grid stability.
Integrating these technologies requires a cohesive communications network for effective grid coordination. Secure distributed energy controls are vital for managing load and schedules through smart charging systems. Without these safeguards, simultaneous high-demand events, like widespread EV charging, could overwhelm utilities and disrupt grid reliability.
The Combined Charging System (CCS), commonly used for non-Tesla EVs in the U.S. and Canada, has known security weaknesses. Vulnerabilities include the lack of mutual authentication, which could facilitate man-in-the-middle attacks, compromising billing information and other sensitive data.
Securing Distributed Control Systems
Currently, no universal standard exists for implementing cybersecurity measures in DERs or the distributed devices within an aggregator’s system. Vulnerabilities often arise from communication gaps between aggregators, DERs, and utilities. Risks include false data injections, man-in-the-middle attacks, phishing, brute-force attempts for credential theft, and denial-of-service attacks.
As control functions become more decentralized, managing roles and privileges becomes increasingly complex. Digitized monitoring also increases the volume of data that needs to be protected, presenting more opportunities for attacks.
The White House highlights that secure-by-design DER management software is crucial for optimizing the operation of various distributed assets, microgrids, and virtual power plants.
Protecting Inverter Controls and Power Conversion
Inverters and power conversion systems are integral to grid-connected DERs like solar panels and wind turbines. Modern smart inverters, with their networking capabilities, expand the potential attack surface. Hackers could target functions managing voltage and frequency stability, potentially causing significant grid instability.
To address these risks, the DOE’s National Laboratories are developing tools for engineers. Sandia National Laboratory’s SolarSnitch intrusion detection system, for example, uses deep packet inspection and machine-learning algorithms to protect and monitor smart inverter communications and identify cyber-physical threats.
Building Energy Management
With the proliferation of IoT and smart devices, energy management systems in buildings now incorporate advanced controls for DERs, such as rooftop solar panels and EV chargers. These additional devices can complicate grid management, especially during unexpected demand spikes.
For instance, a sudden increase in residential air conditioning use during a heatwave can push transformers to their limits, potentially leading to outages. Similarly, energy storage systems managed by virtual power plants could exacerbate these issues if they initiate charging without regard to grid conditions.
Enhanced visibility and secure communication networks are essential to manage these challenges effectively, allowing real-time data transfer between utilities, grid-edge devices, and intermediaries to prevent disruptions and maintain grid stability.