Cybersecurity of PV systems

Cybersecurity covers the technologies, processes and controls that protect systems, networks and data from cyber-attacks. PV plants carry real cyber risk because their inverters, power plant controllers and monitoring systems are connected to the internet so operators can watch them and send remote commands. Once PV equipment is online, unauthorized users may be able to access and manipulate system data or devices. This applies especially when a Modbus interface is enabled. Basic measures are a firewall, closing network ports that are not needed, no port forwarding, remote access only through a VPN, and network segmentation. Guidelines also call for changing factory default passwords, using a different password for each plant, separating read-only and administrator roles, keeping firmware current, and avoiding wireless access unless it is needed. Best practice is to begin with a risk assessment and run a cybersecurity management system on a plan-do-check-act cycle. Countermeasures are mapped onto zones and conduits of the system architecture, an approach in line with the defense-in-depth principle. Data loggers should not be directly reachable from the internet, and control commands should go to the control device over a secure VPN. Two-factor authentication adds further protection. Battery storage owners have similar duties: balance-of-plant equipment that is misconfigured on the network can become a source of vulnerabilities.

<!-- review notes

• sentence 6: support check: partial - Risk assessment, PDCA CSMS, and zones and conduits are stated, but the defense-in-depth link is not stated in the passages (u25 is only a control name with no explanation).
• sentence 8: support check: partial - Misconfigured balance-of-plant assets as a vulnerability source is stated, but 'owners' having 'similar duties' is a loose paraphrase (passage says all parties involved must take steps). -->