In practice, a microgrid is a miniature version of the main electric grid but has the ability to connect and disconnect its power generation sources from the grid as needed. This makes microgrids a valuable resource for water and wastewater utilities offering redundancy when it comes to keeping the power on. However, while utilities may be using microgrids for a variety of necessary reasons, it’s important to assess the threat landscape that these systems could pose as they can potentially open your utility up to a variety of additional threats and vulnerabilities.

The integration of digital controls and communication networks in microgrid systems introduces a diverse attack surface. These include critical components like microgrid controllers, battery storage systems, and energy generation systems (including inverters and solar arrays), as well as third-party software and hardware dependencies. Insider threats also become a problem as the operability of these systems introduces new personnel involved in maintaining their operation which can add additional security concerns as these employees operate critical functions of these systems. There are also physical security risks since many of their components are located outdoors or in easily accessible areas.

Like with the adoption of any new technology, microgrids should be included in a utility’s cyber-physical risk assessments and mitigation strategies. This includes incorporating them into employee training and awareness programs, third-party risk management efforts, incident response plans, and policies and procedures. As each water and wastewater utility has a different relationship with microgrids, developing a customized mitigation strategy is paramount. For more detailed guidance on mitigating the possible vulnerabilities inherent in microgrids, visit Industrial Cyber