# Enhancing Cybersecurity in Smart Grids: False Data Injection and Its Mitigation
## 3 Classifications of Cyber-Attacks in SGs  
According to EPRI, all the parts of SGs must work in simultaneously in a secure way [48]. Thus, complete security cannot be provided without cybersecurity technologies, policies, and risk assessments and one of the most critical dimensions: education and awareness. This is because security vulnerabilities are also seen in the studies as mostly occurring depending on the human factor [29; 55]. By overcoming the people in control of the system, it is much easier to circumvent antivirus software, systems reporting attacks, or bypass firewalls. Even if all technical regulations and security policies are developed and determined, users with lack of awareness will disable these technical solutions. Although information security gaps can never be eliminated, they can be reduced to an acceptable level by developing information security awareness among employees and transforming this awareness into behaviour [39]. All the attacks are critically dangerous for the infrastructure sector, but there is a great danger if they originate from a disgruntled insider who knows the system's features. Institutions generally rely on existing SCADA systems' tight physical security and consider that they are safe from such an attack. Therefore, when faced with an attack, they are exposed to severe losses and damages. When the attacker gains control over the system, the management and activation of the attack have begun. In this process, after the malware is loaded on computers, a connection is opened with the command-and-control systems that allows attackers to access infected systems remotely. After remote access was achieved, the attackers upgraded the privileged accounts, obtaining user credentials [70]. The SG works with advanced technologies such as big data, IoT, and cloud computing to preserve complex CPS security [71]. CPS refers to a system that monitors and controls people and their physical processes in the cyber world using advanced computing and communication technologies [72]. Since CPS security is important at all levels, attacks can have an effect on both cyber and physical infrastructure [73]. Dueto its own physical and logical regulations, CPS is a crucial part of the SG. It regulates the infrastructures of communication, information technology (IT), security, automated control, protocols, standards, and features [74; 75]. Moreover, the threat of cyber physical attack is a critical issue in human society, where an attacker can exploit and leverage vulnerabilities in the SG for personal advantage or to advance political goals [76]. Because of attacks challenge, NIST is working on the future power grid, which includes components for connectivity, electricity, and information [77], and it is considered the light shed between the physical and cyber worlds. SGs architecture and infrastructure are faced with cybersecurity attacks and challenges ranging from thefts, terrorism, natural disasters, etc. In the event of SG's breakdown due to any of the threats, potential consequences include power system blackouts (small and large outages), IT infrastructure failures, false visualization of the actual system's condition, damaged consumer devices, energy market chaos, endangered human safety, etc. [78]. It can be seen in Figure 5[79] that CPS is an essential part of control systems architecture which is related to the field of integrated sensor and actuator networks [80]. Significant disruptions to critical infrastructures due to deliberate attacks on SG Control systems or unintentional attacks such as slammer worms can cause far more national economic damage than the infrastructure itself. For example, an attack [81] includes the examination, loading, and execution. The attackers used a virtual private network (VPN) to gain access to the control system. Then, workstations, servers, and some HMIs and logs are deleted with KillDisk software and other machines' events to avoid leaving traces. It was stated that at least 27 transformers and 225,000 customers were affected due to the attack [81].