Dive Brief:
- Energy storage systems, as well as other newer forms of distributed energy resources, could be particularly vulnerable to cyberattacks and other security risks because of their reliance on cloud-based computer software, experts said Tuesday during a panel hosted by the Clean Energy States Alliance.
- While the panelists said they were not aware of any direct attacks on energy storage systems to date and acknowledged the importance of energy storage to the energy transition, they also said such systems would require greater cybersecurity safeguards than more traditional energy technologies.
- Speakers urged regulators and utilities to run a cybersecurity risk assessment and put protocols into place for addressing potential cybersecurity breaches within their energy storage or distributed resource networks.
Dive Insight:
Energy storage, coupled with other distributed energy resources and cloud computing, represents a major potential boon to the energy transition and utilities, Howard Gugel, senior vice president of regulatory oversight at the North American Electric Reliability Corporation, said during the CESA panel. But while connectivity to the cloud can enable remote repairs at a mass scale and other impressive feats, he said this same capability also gives him some reason for pause.
“It raised a wow factor from two perspectives,” he said of his recent observation of a mass update sent out to an inverter-based resource. “One, wow isn’t it great that we are able to respond quickly and fix a problem … But then the other wow is, if this were to fall into the wrong hands … this could have been a bad situation.”
Gugel noted that while energy storage isn’t unique in this regard, the fact that most energy storage systems are relatively new means they are more likely to integrate some form of Wi-Fi or Bluetooth connection, and to rely on software or data based in the cloud. Those connections open utilities to cybersecurity risks that weren’t present in the past. That might include a targeted attack, he said, but it could also involve a simple mistake in a software update that is subsequently distributed en masse to battery systems made by the same vendor.
Sai Ram Ganti, a cybersecurity researcher at the Electric Power Research Institute, explained that the level of risk associated with any one system depends heavily on how it is configured — as well as its size and how much the grid depends on its continued operation. While most energy storage systems involve some kind of connection to a cloud server managed by the systems’ vendor, some systems provide vendors with read-only connections where the vendor can see and collect data about the batteries’ operations, but they can’t remotely operate the system. Other batteries have a two-way connection to the cloud server that allows the vendor to perform maintenance and install updates remotely — which could also represent a significant threat if the cloud server is compromised, Ganti said.
Energy storage systems can also pose challenges when utilities want to conduct security testing, Ganti said, because most of their on-board systems do not have sufficient bandwidth to complete test-related tasks without malfunctioning. As a result, developing testing protocols in isolated environments that reflect real-world operating conditions can be difficult, he said.
Utilities with battery systems that use these two-way connections should ensure they have access to some kind of override mechanism, Ganti said. He urged utilities to collect baseline operation data on newly installed storage systems so that they can more easily detect signs that a system has been breached or compromised, and he said utilities should run risk assessments on all of their utility-scale storage installations and develop a tailored plan for responding to and mitigating a potential breach of their or their vendors’ systems.
Ganti also recommended that utilities avoid buying energy storage systems made outside the U.S. unless those systems arrived free of any silicon chips or controllers as “battery packs without brains” to reduce the odds they could be compromised by foreign actors. But his colleague Xavier Francia, also a cybersecurity research at EPRI, disagreed with geography-based bans, arguing that it was impractical to implement and could give utilities a false sense of security when cybersecurity risks could be introduced to energy storage at any point within the system’s lifespan.
“The better security strategy here is really about security monitoring and incident response,” Francia said. “When an attack does happen in spite of all your efforts to prevent it … there still needs to be a good instant response plan to minimize the scope of the attack and determine its impact.”
While multiple industry organizations including NERC have or are in the process of developing cybersecurity standards for energy storage systems, Gugel acknowledged that there was nothing in place currently that would prevent a utility or developer from using equipment that does not meet these standards.
Francia said that the interconnection process could provide utilities with an avenue for controlling the quality of systems with access to the grid. But while this is currently a topic of conversation at many utilities, he said he was not yet aware of any utilities that have implemented a cybersecurity review in their interconnection process beyond the broader third-party reviews they already require.
