# Enhancing Cybersecurity in Smart Grids: False Data Injection and Its Mitigation
## 2 Cybersecurity Vulnerabilities in Smart Grids and Mitigation Requirements
### Security Standards of Communication Systems Mitigation  
Substation communication of SG plays a critical role in intelligent power energy system management. Therefore, communication security and related causes are crucial to power system security and should be carefully studied. Communication problems concerning information can be classified into five general categories for their objectives, availability, integrity, confidentiality, authenticity, and non-repudiation [6]. SG systems have too many interconnected devices. It is also highly susceptible to cyber-attacks due to security vulnerabilities found in devices connected to the network. The defence and security layers of SG protect the network against cyber-attacks, unwanted changes, and data theft. For reasons such as efficiency, cost, and integration to big data, SGs depend on comprehensive internet networks where common information is shared. Due to the internet networks to which SGs are connected, they are vulnerable to many attacks that cause interruption of power supplies [39; 40]. This increase in security attacks has created a more demanding control requirement to ensure a smooth SG communication system. Therefore, it is exposed to the general problems and threats of internet networks. Figure 4: Smart Grid subsystems. As power systems become more secure and complex, SGs also need more connections to highly external networks, especially the internet. However, this commitment to the said external networks causes cybersecurity vulnerabilities and violations [41; 42; 43; 44]. Therefore, all communication links in SG networks must have access to high security. When choosing encryption technologies and standards, the criticality and risks of the communication system that needs to be protected should be evaluated. * The ISO 27,001 standard is vital in providing communication security. It defines the functions that must be performed within the scope of living information security. Information security management system (ISMS) standard defines the organizations' needs to establish an ISMS. ISO/IEC 27,001 consists of twelve parts. These are risk operation, security of human resources, security policy, physical security, environmental security, communication and operation management, asset management, entry control, development and reparation, information security management, acquisition and business permanence management submission [33]. * The NIST standard started with the priorities determined by for SGs and added the subjects it determined. The eight priorities identified are: Meeting the demands and consumer energy adequacy, Large area application awareness, Energy storage, Electricity transport, Advanced measurement infrastructure, Distribution network management, Cybersecurity, and Network communication [41; 42]. * The FERC SSEMP standard sets the standards that must be followed in communication networks connected to power systems [42]. * The Common Criteria (CC) that can be evaluated among the standards is internationally accepted SC evaluation criteria for information technology products. They were created as a result of the merger of The Information Technology Security Evaluation Criteria (ITSEC) in Europe, Trusted Computing Security Evaluation Criteria (TCSEC) in the USA, and Canadian Trusted Computer Product Evaluation Criteria (CTCPEC) [44] in Canada, which are accepted as information security evaluation criteria. CC are defined in the ISO/IEC 15,408 standard. It also defines the Evaluation Assurance Level (EAL) levels [44; 45]. * AGA Report No. 12 Part 3 includes protection of SCADA Communications Networked Systems. It is focused on high-speed communication systems, including the Internet [44; 45]. It is notable that AGA series are voluntary standards and do not mandate any companies to install encryption technology as recommended in the standards. * Virtual Private Networks (VPNs) and Internet Protocol Security (IPSec) technologies provide the security of wired grids.