Cyber Security Assessment of Distributed Energy Resources

New distributed energy resource (DER) interconnection standards require communications and interoperability to provide grid operators greater flexibility for delivering voltage and frequency support. These communication channels are designed to allow utilities, aggregators, and other grid operators the ability to enable and configure various grid-support functions. However, these capabilities expand the power system cyber security attack surface and pose a significant risk to the resilience of the electric grid if controlled in aggregate. To advise the solar industry, grid operators, and government of the current risks and provide evidence-based recommendations to the community, Sandia performed cyber security assessments of a communications-enabled PV inverter and remote grid-monitoring gateway. The team found several well-designed security features but also some weaknesses. Based on these findings, recommendations are provided to improve the security features of DER devices.