## 4 Technology
### Security  
As said above, smart grids exploit ICT technologies to provide \"awareness\" about the state of the grid. Thus, it is possible to implement load shedding features to manage peak demands, production analysis for energy generation, dynamic pricing, _etc_. On the other hand, ICT introduces issues related to security. Smart grids lead to a set of new challenges that require new approaches in the field of cyber security, because many of the already existing mechanisms are not applicable. This difficulty is mainly due to the nature of the equipment installed in the power grid. They were purpose-built and they do not have the computational resource needed to manage security features. The National Institute of Standard and Technology (NIST) describes the problem of smart grid cyber security strategy [27]. The first goal is prevention, but on the other hand, a response and recovery strategy in event of a cyber attack is required. This strategy can be described in five steps:  
1. Use cases description of the applications will be developed. The information needs will be mapped to existing transmission and distribution power system models, which will be extended as required. 2. Definition and implementation of an overall cyber security risk assessment process for the smart grid. Risk is the potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by its likelihood and the associated impacts. 3. Creation of a common framework provided by the set of use cases, which perform the risk assessment, develop the security architecture, and select/tailor the security requirements. Figure 7: Application Framework Architecture for embedded devices [26]. 4. Development of a security architecture, which will overlay the security requirements on this architecture. The objective is to ensure that cyber security is addressed as a critical cross-cutting requirement of the smart grid. It is also needed the assessment of smart grid standards that are not conflicting with security requirements. 5. Develop a conformity assessment program for security requirements. We can distinguish between two different classes of attack on a smart grid: cyber and physical. The first class of attacks may lead to eavesdropping of private information or may cause a misbehaviour of physical components managed by software routines. On the other hand, physical attacks may lead to AMI bypassing in order to falsify accounting values or may cause instability due to physical destruction. Considering cyber attacks, we can divide them into four categories as proposed by [PERSON] _et al_. in [PERSON] _et al._ (2014)  
* **Device attack:** compromise the control of a grid device. Typically it is the first step of a complex attack. * **Data attack:** aims at inserting, altering or deleting the data flow in the network, in order to get misbehaviours. * **Privacy attack:** attempts to use electricity usage data to learn or infer users' personal information. * **Network availability attack:** it aims to use up or overwhelm the communication and computational resources of smart grid and to result in delay or failure of communication. The main issue in gaining good levels of security in the smart grid is achieving a reliable protection against mixed physical and cyber attacks. Typically, cyber security does not provide an analysis of the possible consequences of physical attacks and, similarly, system theory does not provide a complete modelling of the IT infrastructure. From the viewpoint of IT, we can identify three main requirements related to cyber security in smart grids as described in [PERSON] _et al_. [PERSON] _et al._ (2014):  
* Confidentiality of power usage: energy usage patterns can reveal personal activities. * Integrity of data, commands and software: integrity of price data is critical, because an attack can cause a misbehaviour of the grid and, on the other hand, integrity of meter data and commands is important but not so critical because it is mostly limited to revenues losses.