# Cybersecurity of Microgrid: State-of-the-Art Review and Possible Directions of Future Research
## 3 The Cybersecurity Aspects of Microgrid
### Efforts and Initiatives for Smart Grid and Microgrid Security  
The research in [52] proposed a baseline requirement and guidelines for data delivery in the implementation of a power grid system to ensure its reliability. The North American Electric Reliability Corporation, for example, has proposed the Critical Infrastructure Protection (CIP) standards, CIP-002 through CIP-009 [53], to provide a cybersecurity framework for the identification and protection of critical cyber-assets and support the reliable operation of the bulk electric system. Another example, the Achieve Energy Delivery System Cyber-Security, has been published by the Energy Sector Control Systems Working Group (ESCSWG) in a study conducted to improve cybersecurity in energy delivery systems [54]. In addition, the National Institute of Standards and Technology (NIST) has published cybersecurity guidelines for smart grid systems [45], in which important threat scenarios are mentioned for the cybersecurity of the microgrid. In microgrid communication, the connection between internal and external networks, such as the enterprise network and the Internet, is widely exposed to cyber-threats. A cyberattack occurs through intrusion into power enclaves of the microgrid through the exploitation of vulnerabilities in the network, system, and/or application level by attackers to compromise critical operations. Researchers have chosen to follow such standards for specific microgrid architectures as NIST 800-53 [55] and IEC 62443 [56]. As they have an internal system design that does not focus on security, a majority of the systems depend on perimeter protection. Such a system is developed as part of a closed network. A drawbacks of the power network is that it is designed without the security of the IEC 61850. A security mechanism is thus needed for these protocols. However, this environment tends to have vulnerabilities that cyberattacks can exploit. The IEC 62351 has been developed to enhance the IEC 61850 in terms of security [57]. However, this enhanced protocol does not include the cybersecurity of the microgrid communication network. Another secure framework that does not offer cybersecurity measures for microgrid-specific threats is the OLE for the Process Control Unified Architecture (OPC UA) [58]. This framework is a standard-based communication backbone that has advantages in case of a larger scale of cybersecurity threats. Examples of such threats include the sensitive control of network exposure, the complexities in achieving cybersecurity certification, and component integration legacy. Microgrid systems are connected to external networks, such as enterprise networks and the Internet, which significantly increases the cyber-threats to them. Cyberattackers can attack microgrid power enclaves and compromise critical operations by exploiting vulnerabilities at the network, system, and/or application level. Most systems rely on perimeter protection, with internal systems designed with less security because they are intended to be part of a closed network. The Secure Network of Assured Power Enclaves (SNAPE) architecture [59], which is based on the network separation strategy, was created for a large US Army base containing multiple power enclaves with secure communication. A microgrid system deployed based on the SNAPE architecture can contribute to the goals of energy security of the US Department of Defense. Network segregation is achieved by hardware devices that provide strong cryptographic separation. The segregation enables the isolation of control networks so that they can use lightweight cryptography to satisfy the requirements of low latency. This novel approach minimises the burden of cybersecurity certification by reducing the scope of certification to a subset of the microgrid network. In the SNAPE architecture, the OLE for the Process Control Unified Architecture (OPC UA) is used to implement the communication backbone. The OPC UA is backward-compatible with distributed control system protocols such as IEC 61850.