# Cybersecurity of Microgrid: State-of-the-Art Review and Possible Directions of Future Research
## 2 The Microgrid Architecture
### Cyberattacks on Microgrid
Another example involves a program that appears to carry out a legitimate task on the target system, yet operates a malicious code in the background; this is known as a Trojan horse. The attacker uses this form of malware to upload a worm or a virus to the target system [35]. The first cyberattack against a physical industrial control system was launched using Stuxnet. 4. Maintaining access Special forms of attack, including the backdoor, virus, and Trojan horse, are used in this final step to maintain permanent access to the target. The backdoor, which is an undetectable stealthy program, is installed on the target by the attacker for easier and faster use in the future. The successful embedding of a backdoor into the server of the SCADA control centre allows the attacker to launch several attacks against the power system that damage it. The security parameters of an IT network are classified based on their order of importance: confidentiality, integrity, accountability, and availability. However the order of precedence of the security parameters of a smart grid is as follows: availability, integrity, accountability, and confidentiality [36]. Thus, we can say that attacks that compromise the availability of smart grid systems are the most severe, while those targeting its confidentiality are the least severe. In addition to severity, the likelihood of each attack to be carried out is important. Although attacks based on Duqu and Stuxnet, for example, are highly destructive due to their ability to bypass all security boundaries and vandalise the industrial control system, they are complex and sophisticated. Hence, even though the severity of these viruses is high, they have a low likelihood of being launched. The HMI popping attack is an example of a highly severe. However, its execution does not demand outstanding experience in security and industrial control systems, or a high level of networking skill. The public availability of vulnerability documentation on devices enables the use of open-source tools, such as Metasploit and Meterpeter, or the so-called script-kiddies, by a hacker to launch an attack. Thus, this attack is considered to be highly severe as well as highly likely [35]. Table 2 summarises common cyberattacks on microgrid based on the four steps identified above: reconnaissance, scanning, exploitation, and maintaining access. Each step includes the attack categories, examples, the component compromised in the smart grid due to each attack, the impact of each attack, and the appropriate countermeasures. It can be concluded that the use of secure network protocols, such as secure-DNP3, as well as the enabling of authentication and encryption mechanisms can help prevent most attacks. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attacking Steps** & **Attack Categories** & **Attack Examples** & **Compromised Element** & **Compromised Security** & **Possible Countermeasures** \\ \hline Reconnaissance & Traffic analysis, Social Engineering & [55] & Modbus protocol, DNP3 Protocol & Confidentiality & Secure DNP3, PKI, TLS, SSL, \\ Scanning & Scanning IP, Port, Service, Vulnerabilities & Modbus network scanning [21], DNP3 network & Modbus Protocol, DNP3 Protocol & Confidentiality & IDS [39], System Automated security compliance checks \\ Exploitation & Virus, worms, Trojan Horse & Stuaret, Doug & SCADA PMU, Control device & Confidentiality Integrity & DLP, SEM, Anti-virus, IDS \\  & Denial of service (DoS) & Puppet attack, TSA & AML, PMU, smart grid & Availability & Availability