# Evaluating Cybersecurity Risks of Bulgaria's Energy Sector: Focus on PV and HVAC-R
## 1 Introduction  
Energy is a cornerstone of a nation's economy and security. The rising necessity to address environmental concerns has pushed academia and industry towards the research, development, and utilization of cleaner energy sources and methods in the context of the smart technology transition [1]. This transition is characterized by the adoption of renewable energy sources (RESs) as the essence of distributed generation (DG), the most predominant of which are photovoltaics (PVs) [2]. PVs' advances and falling prices have given rise to their appeal not only in industry but also in residential systems throughout the last decade. Despite the numerous advantages of PVs, there are concerns about their reliability, sustainability, safety, and security, to which cybersecurity is intrinsic. The US Department of Energy has used the term \"cyber event\" in a broad way, which describes any disruption caused by unauthorized access that is not by definition a cyber-attack and can easily be attributed to a human mistake [3]. Due to the inherently intermittent output of PVs [4], it is challenging to evaluate whether a cyber-attack or a human mistake has occurred based solely on parameter observation. The only conclusion that can be drawn is that the PV installation is not operating nominally. Contemporary power plants, industrial systems, smart grids, and even more so PVs can be treated as cyber-physical systems (CPSs) [5, 6]. CPSs are controlled remotely by programmable logic controllers (PLCs) and monitored by supervisory control and dataacquisition (SCADA) systems [7; 8; 9; 10]. These are heavily reliant on their secure communication. This is where cybersecurity is focused [4; 11]. The STUXNET attack in 2010 has shown that there is an evident need to take the cybersecurity of CPSs into account. The saturation of the energy system with renewable energy sources, mainly photovoltaics, has led to a serious need for balancing, due to the time offset between production and consumption. Therefore, it can be argued that the share of hybrid inverters that support energy storage devices will increase. Such a trend is already observed and can be predicted, with a high probability that it will intensify. Hybrid inverters, in terms of communications and control, are more like Internet-of-Things (IoT) devices and fundamentally differ from classic control systems in the energy sector. This sets new requirements for cybersecurity. Critical energy facilities--such as nuclear power plants--are logically and physically segregated from \(\Pi\) networks, and thus prevention against many possible cyber-attacks is achieved. Hybrid inverters are relatively low-power devices and therefore cannot be classified as critical. Indeed, even a successful cyber-attack against one device cannot lead to serious consequences for the entire energy system. Current trends, however, are for a very intensive penetration of hybrid inverters, resulting in significant total installed power. There is a large number of low-power devices, which have a common manufacturer of both hardware and software and use the same cloud for management. Due to their shared platform, a cyber-attack can easily be carried out on all devices and as a result disrupt the operation of a cumulatively large generating capacity. If trends continue, very soon the total power will be so large that it will affect the normal operation of the entire energy system. Because of this, other researchers such as [PERSON] et al. [12] propose that PVs should be included in the critical infrastructure category of respective national security and national energy resilience. The penetration of hybrid inverters presents opportunities for both classic cyber-attacks and the weaponization of the technology. Additional concerns arise from the fact that the energy professionals who install and operate the new devices have virtually never encountered cyber issues, simply because classic generators are naturally immune.