Cyber-Physical Security of Distribution Networks with High Penetration of Inverter-based Resources

Australia is rapidly advancing towards a net-zero carbon energy system, with the complete phase-out of coal-fired power stations expected by 2040. This bold transition is driving unprecedented investment in renewable energy sources, storage solutions, and gas-powered generation, as the nation seeks to ensure a secure, reliable, and affordable electricity supply for all. This shift redefines not only how electricity is generated but more importantly how the entire electrical network is operated. To achieve this goal, the Australian grid must evolve into a highly automated, intelligent, and digitalized system capable of integrating, managing, and securing large-variety decentralized renewables and storage systems. At the heart of the transformation are two key technical fronts. The first is the widespread adoption of distributed energy resource (DER), such as roof-top solar and in-house battery storage systems. By 2024, over 3.5 million Australian households have adopted these technologies, turning everyday consumers into active participants in the nation’s energy revolution. The second involves the increasing role of the distribution network in coordinating DERs to enhance grid stability and lower electricity costs through active demand management. This coordination is empowered by advancements in information and communication technologies (ICT). Based on the distributed coordination, DERs can be integrated into virtual power plants (VPP), collectively providing gigawatts of dispatchable capacity. As Australia is adapting to these evolving technologies, there is a growing risk being introduced to the electricity network, particularly due to the rapid growth of large-scale online DERs. With millions of DERs installed at customer sites, the attack surface has expanded, making these devices more accessible to potential threats, especially when integrated with building automation systems and public ICT networks. This challenge is compounded by the fact that many DER owners lack the specialised knowledge, resources, or awareness needed to manage the cyber security of their smart inverters effectively. Furthermore, third-party entities, such as smart inverter manufacturers and DER aggregators, often have remote access to these systems. They provide essential services like cloud storage, real-time performance analytics, and remote maintenance, but this access also opens up critical pathways that could be exploited for remote command injection or unauthorized control. As these interconnected systems become more integral to our energy infrastructure, they create a complex web of potential vulnerabilities. Addressing these cyber security challenges is crucial to safeguarding the stability and security of the Australian grid, ensuring that the transition to a decarbonized grid does not come at the cost of increased exposure to cyber threats. In the vivid existence of growing cyber threats, the Australian electricity grid is not fully prepared to face these impending challenges. Firstly, there is a lack of specific regulations that address the uniqueness of electricity networks. Existing regulations, such as the Security of Critical Infrastructure Act 2018 and its subsequent amendments, provide a broad framework for critical infrastructure protection. However, these broad policies do not account for the milli-second transient of the electricity grid. Tailored regulations, focusing on real-time detection and mitigation, would help ensure consistent security across the electricity grid with substantial power-electronics-based devices. Secondly, the approach to cyber incident response remains passive. While Australia has made significant progress in detecting and responding to cyber incidents, the overall strategy leans towards reaction rather than prevention. Proactive measures such as regular threat predictions, systematic vulnerability assessments, and penetration testing are necessary to identify and mitigate risks before they are exploited. This requires a shift in focus from compliance-driven security to a more risk-preventing approach, Thirdly, there is a notable lack of collaboration in cyber security research and its application to electricity networks. The nature of current research efforts limits the development of comprehensive solutions that address cyber security challenges resulting from the increasing use of online devices. Stronger collaboration between academia, industry, and government agencies is needed to develop holistic cyber security frameworks that integrate the latest research into practical applications for energy networks. Finally, industry engagement in cyber security initiatives is not sufficient to meet the evolving cyber challenges. So far, only a few industry-driven projects have been initiated. These projects, such as those focusing on data security, operational monitoring, and risk-limiting practices, offer valuable insights. However, there is still insufficient research on understanding the taxonomy of cyber-physical attacks, their consequences, and effective countermeasures. A deeper exploration into how cyber threats affect the physical infrastructure of the electricity grid is essential in developing proactive detecting and mitigating strategies. More industry-academia collaborations and R\&D programs are needed to bridge this gap and drive innovation in cyber defense strategies. As an important attempt toward these goals, this digital white paper presents a systematic investigation of the cyber challenges and contemporary defense strategies. In Chapter 1, we begin with a systematic introduction to the key characteristics of future power-electronics-dominant electricity grids (PEDEG), focusing on their inherent stability and transient issues. Building on this foundation, we explore the taxonomy of cyber attacks on electrical cyber-physical systems, analyzing various types and targets of these threats in Chapter 2. Chapter 3 offers an in-depth examination of vulnerability and risk assessment within PEDEG, with particular emphasis on its millisecond dynamics. In Chapter 4, we review contemporary detection and mitigation strategies, highlighting both model-based and data-driven approaches. Following these two mainstreams, Chapter 5 delves into mitigation and countermeasures. Chapter 6 contributes to the survey and comparison of the latest policies and regulations in this field. Challenges and future research are summarized in Chapter 7.