# Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid +
## 5 Potential Countermeasures to Cybersecurity Threats
### Potential Countermeasures for Availability Threats
Some promising solutions for the smart grid include, (1) trusted computing [147], (2) attestation [148], (3) diversity, (4) secure bootstrapping [141], and (5) secure patching [141]. Since Smart Grid applications can have strict delay requirements (on the order of a few milliseconds), DoS attacks against their wireless channels are particularly effective. Countermeasures in this category are primarily concerned with anti-jamming solutions and they may be categorized by (1) efficient and robust detection and (2) DoS-resilience schemes. [36]. In [126], the authors propose a method to detect the jamming channel attacks. In [30], the authors introduce a new metric called message invalidation ratio to analyze the effectiveness of a designed jamming detection system in different attack scenarios. System-theoretic solutions relate to solutions for False Data Injection Attacks. As described in [21], FDIA detection algorithms may be categorized as follows: model-based and data-driven detection algorithms. Model-based attacks are further categorized by static state-estimation techniques, dynamic state-estimation techniques, and other model-based techniques. In [149], the authors model the False Data Injection Attack, enabling the design of model-based detection schemes. The authors in [51; 52; 53; 54; 55; 56; 57; 58; 59; 60; 61] present static state-estimation techniques. In [62; 63; 64; 65; 66; 67; 68; 69; 70; 71; 72; 73; 74; 75; 76; 77], some dynamic state-estimation techniques are presented. Some other model-based detection schemes are presented in [78; 80; 81; 82; 83; 84; 85; 86; 87; 88; 89; 90; 91; 150]. Similarly, data-driven detection algorithms may be further subdivided into machine-learning based algorithms, data-mining based algorithms, and other data-driven algorithms. Some supervised machine-learning based algorithms are presented in [92; 93; 94; 95; 96; 97; 98; 99; 100; 101; 102; 103; 104; 105; 106; 107; 108; 109; 110; 111; 112; 113; 114; 115; 116; 117; 118; 119; 120; 121; 122; 123; 124]; and reinforcement-learning based algorithms are presented in [116]. Data-mining based detection algorithms are presented in [117; 118; 119; 120], and other data-driven detection algorithms are described in [121; 122; 123; 124]. Perhaps one of the more challenging aspects of securing ICS networks in general is to implement effective countermeasures against malware threats. Some recent high-profile attacks, including Stuxnet and Havex, utilized zero-day exploits and concealment [154]. In [154], the authors propose the use of multi-layered strategies (i.e., defense-in-depth) to mitigate some of these threats, among others. An effective defense perimeter for the OT and IT portions of the network, as shown in Figure 4 may prevent some of these attacks from starting. However, due to misconfigurations, backdoors, etc. this is not a guarantee. The IT side of the network should also use endpoint protection, a SIEM, etc., in order to detect known threats. However, there are also zero-day threats, supply-chain threats, social engineering threats, USB devices with malware, etc. The NERC CIP standards [2] include standards for supply chain management and device patching. All of these are a good place to start to defend against malware threats. However, development of more effective countermeasures for these threats offers a good opportunity for future research into SG and ICS networks in general.