# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 1 Introduction
### DER Control and Attack Processes  
A digital energy infrastructure is composed of several ICT areas with different functionalities and goals, structured in a layered architecture. Components within each area communicate with each other by means of local networks, but also with remote devices in other zones exploiting possibly heterogeneous technologies. The inter-area connections introduce additional vulnerabilities while extending the impact of existing ones over multiple domains with diverse resilience strategiesand security policies. A key principle to secure digital energy architectures is segmenting the various environments into different trust levels.  
This paper addresses the analysis of cyber attack processes targeting an OT architecture of significant grid users (SGU) with flexible energy resources possibly controlled by transmission system operators (TSO), distribution system operators (DSO), or aggregators. The DER domain is particularly relevant in the energy transition scenarios targeting the long term objectives till 2050, as stated at the European level by the clean energy package, and by each national energy and climate integrated plan. In terms of security, this domain extends the IT/OT/ICS perimeter of a given grid operator with further network branches owned by DER operators or aggregators with lower security capacity. The specifications of the suitable cyber security requirements and measures, as security monitoring systems, for protecting the extended perimeter by attacks to DER networks, are the subject of future energy sector regulations.  
Attack processes are not atomic actions but can be decomposed in several attack phases (see, e.g., [7,8]) and their realisation can last even several years. Real attacks on energy systems, such as Stuxnet [9], and more recently the attacks on the Ukrainian power grids (BlackEnergy 2 and industry/CrashOverride) [10,11], start with the compromise of a node in the corporate network, and then the attacker moves from the enterprise area to the OT network to reach the final target. In the process, the attacker leaves traces that can be used to intercept malicious activities in the initial phases, before the attacker reaches the most critical assets. The knowledge of the attack structure is of great help for the implementation of defence strategies.  
As we detail in the next sections, our analysis centres on attack processes targeting SGU OT networks (Figure 1) which are typically characterised by a plant controller with external and internal communication interfaces. The external interfaces allow the operators to monitor and control the plant behaviour, and also to remotely perform maintenance activities. Through the internal interfaces the plant controller reaches the field devices, e.g., smart meters and inverters, in charge of getting the electrical measures and actuating setpoints. This paper analyses the last phase of attack processes on SGU OT networks starting from a compromised plant controller, and by including in the model security knowledge from the DER domain, it shows how the DBN model supports the attack forecast and diagnosis by correlating the attack techniques with observable events.  
Figure 1: Reference architecture.