## 6 Cybersecurity
### Cyber-Attacks on Power Energy  
A discussion of major cyber-attacks affecting the PV systems and energy industry in the last few years is presented here. One of the most elaborate and cleverly executed cyber-attacks on a power grid occurred in Ukraine on 23 December 2015. It caused a six-hour outage for hundreds of thousands of consumers in and around Kiev [97]. A regional distributor was affected, and there have been reports of malware found in Ukrainian companies across a range of critical infrastructure. This is believed to be the first case to have a significant impact on the security and safety of the power grid everywhere. The investigation report [98] showed that the intruders used remote industrial control system (ICS) client software or pre-existing operating system remote administration tools over virtual private network (VPN) connections to perform malicious remote actions on the circuit breakers. To facilitate remote administration, the attackers are believed to have obtained legitimate access and credentials (usernames and passwords) in advance. A second cyber-attack took place in Ukraine on 17 December 2016, almost a year after the previous attack. It affected the Pivnichna substation outside Kiev, leaving people \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**References** & **Threats** & **Prevention/Detection Measures** \\ \hline \multirow{4}{*}{[85]} & & Neural network-based attack detection \\  & & Use of intrusion detection system \\  & & Add intrusion signatures \\  & & Add proxy and firewall rules \\  & & Access parameter sanitization \\  & & Encryption mechanism: Transport Layer Security (TLS) protocol \\ \hline \multirow{4}{*}{[89]} & & Firewall rules \\  & & Antivirus solution installed \\  & & Encryption implementation \\  & & Prediction framework: cellular computational network (CCN) \\ \hline \multirow{4}{*}{[91]} & & Communication protocol encryption \\  & & Network security (microsegmentation, firewall, proxy, load balancer rules) \\  & & Data encryption \\  & & Encryption and checksum implementation \\  & & Transport Layer Security (TLS) protocol \\  & & SSH public key authentication \\ \hline \multirow{4}{*}{[93]} & \multirow{2}{*}{Relay attack} & Use of secured protocol (sTELNET instead of TELNET protocol, or FTP-SSL for file transfer instead of DTP) \\  & & Implementation of least privilege principle \\  & & Implementation of MFA (Multi-factor authentication) \\ \cline{1-1}  & & Strong password \\ \cline{1-1}  & & Role-based access \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Cybersecurity threats and countermeasures for PV systems. without electricity [99]. It caused a blackout that lasted for an hour, and a fifth of Kiev's electricity consumption was lost. The analysis report [100] shows that the malware called \"CRASHOVERRIDE\" was used in the second attack from Ukraine. Its frameworks include modules specific to ICS protocol stacks, but it also includes non-ICS-specific modules such as a wiper (deletes files and processes from the running system to launch a destructive attack on operational technology equipment). On 5 March 2019, attackers targeted a renewable energy company based in the US. The company experienced a denial-of-service attack and the event caused grid operators to lose communication with solar and wind generation sites, leaving operators without access to the generation systems for around twelve hours [101]. A German wind turbine operator was affected by a cyber-attack in February 2022. It was reported that the remote monitoring and control of thousands of wind turbines had failed due to a communication failure between a satellite and the wind turbines [102]. On 12 April 2022, the Computer Emergency Response Team of Ukraine (CERT-AU) reported a cyber-attack on a Ukrainian energy company [103]. The attackers used a malicious program named Industroyer2 (a version of CRASHOVERRIDE used in 2016) to target elements of critical infrastructure, such as high-voltage substations.