# Evaluating Cybersecurity Risks of Bulgaria's Energy Sector: Focus on PV and HVAC-R
## 5 Risk Assessment of PV Plants with Hybrid Inverters
#### Threat Scenarios  
Threat scenarios are derived by considering the possible channels for gaining unauthorized access to the control of the inverter or BMSs. \begin{table}
\begin{tabular}{c l} \hline \hline
**Score** & **Value** \\ \hline
1 & Low—happens very rarely or there are no records of such a scenario. \\
2 & Moderate—there is a history of such scenarios, but they are not common. \\
3 & High—frequently occurring scenarios that are well known and described. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Likelihood. \begin{table}
\begin{tabular}{c l} \hline \hline
**Score** & **Value** \\ \hline
1 & Single device (or small number of devices) \\
2 & Device group—for example, all devices of a given installer \\
3 & Large number of devices—all devices of a given vendor \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Impact. \begin{table}
\begin{tabular}{c l} \hline \hline
**Score** & **Value** \\ \hline
10+ & Critical \\
6–10 & High \\
3–6 & Medium \\
1–3 & Low \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Risk assessment scale. A breach in the access rights authentication system: Unauthorized access can be obtained by bypassing the security measures of different software. The authorization of an individual owner, an installer, or a manufacturer can be breached, with the latter causing the most damage. Such breaches occur regularly, so the likelihood is assessed as moderate. \"Difficulty\" and \"impact\" are assessed as moderate, as common measures against such attacks provide a certain level of protection. Attack through installer access rights: Typically, installers have access, albeit incomplete, to the inverter management system. A breach of their credentials can occur in various ways. In most cases, installers have little training in cybersecurity. Such a scenario is considered moderate to achieve, has a moderate likelihood, and leads to moderate impact. Attack through manufacturer access rights: An attack that is similar to the above, but through the manufacturer. Large manufacturers are usually well prepared for such scenarios, but this is not always the case with low-cost companies. Manufacturers are usually attacked along the supply chain. Major impact is possible, serious resources are required, and there is a moderate likelihood. Attack through inverter interface: Inverters are equipped with additional interfaces through which their operation can be controlled. Theoretically, an attack through them is possible. In reality, at least in Bulgaria, this is difficult nowadays. Chinese manufacturers make very frequent and serious changes, do not keep strict communication protocols, etc. For example, control via Modbus RTU is difficult to implement, since the registers are constantly changing (even with updates). The scenario can cause serious damage on a constrained number of devices, but it is difficult to implement and with a low likelihood. Attacks through unauthorized devices (backdoor): This refers to additional means of communication that are hidden in the inverter. Recently, there have been reports of exactly this type of attack [81], which, however, require further verification. The question arises as to why additional communication channels are needed when the main one is available. In this way, it is difficult to gain simultaneous access to many devices, the likelihood is low, and the difficulty is moderate. Malicious firmware (manufacturer not involved): This scenario assumes that a hacker group successfully attacks the manufacturer, gaining access to the firmware and the cloud infrastructure. Such an option cannot be ruled out in a highly competitive industry, but it requires very large resources. Such attacks in industry have been documented, but not in the energy sector. A large number of devices could be affected, but the likelihood is low. Malicious firmware (manufacturer involved): This scenario has two dimensions. On the one hand, data on the location of the inverter, consumption, and generation of electricity can be illegally obtained and processed.