2.1 Smart Grids

One of the main SG applications is the Smart Metering System (SMS), which is composed of a set of technologies to measure the consumption/production of electrical energy and report this data to billing systems in the utilities. The SMS allows end-users to check their consumption/production patterns and facilitate the process of energy use to achieve better sustainability use of electrical energy [⁵].

The most critical components of SMS are the Smart Meters (SM), Communication Networks (CN), the Measurement Data Management System (MDMS), and other utilities’ information systems and applications [⁶].

There are other essential components such as Appliances (A), Smart Appliances (SA), Distributed Energy Resources (DER), Data Concentrators (DC), Display Information Devices and Applications, among others. The most implemented architecture of SMS is the Advanced Metering Infrastructure (AMI) [⁷].

AMI defines a work of interoperability among the SMS components. The SMS is a complex system due to the vast diversity of components. For instance, CN are diverse and forms different tiers according to its geographical location.

Behind the meter exist a CN composed by SA and DER which communicate with SM, this network is called Home Area Network (HAN) if the SG is at home, Building Area Network (BAN) whether in a Building, or Industrial Area Network in an industry. In front of the meter exists others CN according the distance and components which are interconnect. The CN formed by SMs and one DC is called Neighbor Area Network (NAN).

The interconnection between other DCs is called Field Area Network (FAN), and the last interconnection between main DC with the utility’s data center is called WAN (Wide Area Network). Also, in the data center exists interconnection between different utility servers form a Local Area Network (LAN).

The main applications of SMS not only include data measuring and reporting to visualizing in web and mobile applications. The utilities can connect and disconnect clients automatically via SM. The SM can publish some alarms and events and also check some security aspects like tampering and fraud detection.

The first SM appeared more than 15 years ago and actually more of them are obsolete. At the moment, the next generation of SM are appearing and bringing new applications to the end-users like data analytics, power quality, among others. One example of these new SM is SMETS2 [⁸].

The SM is the cornerstone of SMS. SM is an embedded system capable of measure energy consumption/production with CN. These capabilities to communicate data through CN make the SM as an IoT device. Right now, other IoT devices are integrated to SM in the form of Intelligent Electronics Devices (IED). The cybersecurity of SM is very important and also its cyber hygiene, and those are vital for cybersecurity in SMS and SG.

In general, IoT is considered as part of a Cyber-Physical Systems (CPS) [⁹]. The four components of a CPS are People, Processes, Data, and Objects. The four elements are so essential, but all begins with people. Human factor is vital in CPS and it is a key factor in cybersecurity through cyber hygiene [¹⁰].

On the other hand, in IoT and other domains, new computational paradigms have appearing trying to improve the performance of the systems. One of these new paradigms is the Edge-Fog-Cloud Distributed Architecture (EFCDA). This novel paradigm allows the partition of the computation capabilities in different tiers according to each device and where the data is needed is closer [¹¹].

Figure 1 shows the implementation of SMS as an IoT and EFCDA. The three tiers of EFCDA are showed. Note that triangles represent one of the four crucial components of CPS: 1. People, 2. Objects, 3. Data, and 4. Processes.

Fig. 1 SMS Architecture based in IoT and EFCDA 

2.2 Introduction to Cybersecurity in Smart Grids

Cybersecurity is the combination of various technologies, processes, and controls that are designed to eliminate risks of cyberattacks [¹²]. The consequences of a security breach are diverse. The significant effects are ruined reputation, vandalism, theft, loss of income, intellectual property damaged, among others.

The use of IoT devices, embedded systems, and other cyber physical systems have increased the risk of cyberattacks [¹³].

One main component of the Smart Cities is the cyber-physical systems. The cybersecurity of any systems is given by the cybersecurity of the least element of its architecture; in this case, all the objects in the cities both physical and virtual, including humans [¹⁴].

SMs are not just for billing, and hackers can steal, manipulate, and disrupt it. There is the possibility to bring down the SG through hacking Supervisory Control and Data Acquisition (SCADA) and SMs. The SG is a centrally managed distributed network of millions of devices ready to be hijacked. Traditionally, the cybersecurity in SG has been focused on SCADA systems because the protection of the most significant assets is vital due to the decentralization of SG [¹⁵].

SCADA systems are present in the generation, transmission, and distribution processes in the utilities. The customer process is as crucial as the other processes. The cybersecurity must be improved in the customer process. The most important customer processes are related to SMS.

Another way to classify the SG for better understanding is through voltage. SG can be divided in High-Voltage (bulk generation and transmission), Medium-Voltage (Distribution), and Low-Voltage (Consumer). Cybersecurity solutions focused on the low-voltage grid are becoming more important. These allow energy suppliers to recognize whether a lack of cybercriminal activity on the low-voltage grid is real or simply that information gathering attacks are going unnoticed.

Recently two aspects have been taken an important role in SG cybersecurity: communications [¹⁶] and sensors [¹⁷]. In addition, communications and sensors are vital in any sustainable city. For this reason, it is very important to strengthen cybersecurity in telecommunications and sensor devices.

The cybersecurity concepts are well expressed in the John McCumber’s Cybersecurity Skills Cube (CSC) [¹⁸]. CSC is composed of three parts: cybersecurity principles (confidentiality, integrity, and availability), information states (transmission, storage, and processing), and countermeasures (technology, policies and practices, and people).

The cybersecurity principles well-known as CIA (Confidentiality, Integrity, and Availability) are the basis of data protection. The most important thing in our time is the data. In the SG utilities, users, and other participants provide data. The data is present on computing devices, operation data, online information, user identity, financial data, among others.

The data is represented in three states: 1. Storage is the static data saved in files, databases and other storage mechanisms; 2. Transmission, who is the data transmitted through CN, and finally, 3. Processing, where the data is processed inside the microprocessors via algorithms implement into the software.

SG operational data is time-sensitive and different in each layer: edge, fog, and cloud. It varies from microseconds in substations and up to seconds and even minutes in SM at the consumers’ premises as well as substations.

The data is protected through a set of countermeasures or controls such as technologies, policies and practices, and people. Traditionally the IT personnel focused on cybersecurity on technologies. Still, in the last decade, with the use of security and IT governance frameworks, the cybersecurity roles have been changed to policies and practices. Some works has been showed the important of human factors in cybersecurity and cyber hygiene [¹⁹].

Data confidentiality is related to personal information. Data are classified according to confidentiality in maximum secrecy, secrets, confidential records, and restricted. In SG, the confidentiality and privacy of the data are paramount. Clients are responsible of its personal and sensitive data; also, the utility is responsible of the personal data of its clients.

Examples of personal data in SG are data consumptions/production records through the time, number of credit cards, financial history, among others.

Data integrity is regarding to quality, accuracy, and validity of the data; while data availability is related to services that are continuously working all the time. The availability of SMS is so vital for the SG operation. The availability of SMS data and services are affected by natural disasters, equipment failures, cyberattacks like Denial of Service (DoS), among others.

A good cybersecurity design implies and availability target of 99.999%, which it represents less than 5.26 minutes per year unavailability. This requires the implementation and monitoring of countermeasures such as Authentication, Authorization and Accounting (AAA).

An example of a AAA is using a credit card in the billing process. Authentication refers to who it is. Authorization refers how much can the customer can spend.

Audit refers how customers spent the money. Authentication requires that all users identify themselves with something they know (password), something they have (card), and something they are (fingerprint).

Authorization is regarding to the privileges in the systems derived to the authentication process. Audit is crucial to understand the user’s actions and to stablish a base line of their activities.

Cybersecurity is expressed in terms of risk. The risk is a probability of a cybersecurity event occurrence. The risk of an asset is related to the increase of threats and the presence of vulnerabilities. The damage of a risk is measured by its impact. Threats are linked to external factors, while vulnerabilities refer to internal factor (weakness).

Risk as a probability is expressed in a percentage between 0 to 100%, where nothing is 0% insecure nor 100% secure. The risks cannot be eliminated but it can be mitigated, reducing the probabilities to occur. The risks are mitigated through using countermeasures and implemented security controls.

Table 1 shows three examples of risk in SG, while Table 2 shows the impacts and estimation of this risks. The risk estimation is shown at section 2.4.

For hackers and malicious people making cyberattacks, trying to obtain sensitive data that represents more revenues. External threats can be foreign people such as cybercriminals, hackers, hacktivists, terrorists, state sponsorship, and fans. Internal threats can be employees and former employees, personnel outsourcing, and reliable partners.

Table 3 shows the evolution of threats through the time. The reader can note that the threats are more specialized in the recent years and the solutions must reached them.

Other threats are human errors, hardware failures, sabotage, and software errors, among others. On the contrary, some examples of vulnerabilities are buffer overflow, inputs not validated, race conditions, weaknesses in security practices, access control problems, among others.

A kind of vulnerability is produced by malware such as spyware, adware, bot, ransomware, scareware, rootkit, virus, trojans, worms, Man in the Middle (MitM), and Man in the Mobile (MitMo). Some cyberintruders could be decrypted WiFi passwords through some cyberattacks such as social engineering, brute force attacks, and network monitoring.

Social engineering is probably the most significant threat that cyber hygiene can be solved. There are different types of social engineering attacks such as pretext, follow-up, something for something (quid pro quo), and the most important: Phishing [²⁰]. Some social engineering tactics are authority, bullying, urgency, familiarity, and trust.

In most cases, the countermeasures and cyber cybersecurity controls depend of cybersecurity policies. The policies are related on how the assets could be protected to guarantee cybersecurity.

The implementation of these policies implies the use of best practices and countermeasures. Table 4 shows some examples of cybersecurity policies and countermeasures to implement it in SG.

Diverse authors have been focused on creating cybersecurity frameworks for SG. For example, [²¹] is shown a framework to detect cyber threats in the energy sector, but still, there is a lack of using social and human factors to prevent cyber risks.

2.3 Introduction to Cyber Hygiene in SG

The average user does not measure the full consequences of ignoring basic cyber hygiene. Administrators see no financial return on cybersecurity solutions. Software developers are rewarded for faster software and new features, but not for making code more secure.

The incentives to make the right decisions are always misaligned [²²]. In general, for end-user some good cyber hygiene practice is do not share too much on social media, email, and web browser privacy, although, cyber hygiene is more complex.

Some example of cyber hygiene practices in SG are conduct a risk assessment, create a security policy, human resources security measures, make and test backup copies, keep patches and security updates, implement access controls, periodically review the response to incidents, use analysis and monitoring tools, inform users of any cybersecurity incidents, encrypt data, make equipment maintenance, update OS, planning to avoid disasters, systems monitoring, checking systems, among others.

There is consensus to consider the need to consider behaviors throughout IoT lifecycles, and SG is not an exception. Through this, key user behaviors can be identified when using SG devices. Besides, it is capable of identifying critical threats that can, for example, place sensitive information or risky behaviors that guide users to the risk of a successful attack.

Cyber hygiene helps establish expert consensus regarding key malicious threats in SG, critical protective behaviors to safeguard SG environments, and risky essential user behavior that helps cyber health of SG cybersecurity environments [²³].

Some cyber hygiene operations are detecting computers infected with malware, detect suspicious network activity, identify irregular authentication attempts, describe and understand inbound and outbound traffic, provide summary information including trends, statistics, and counts, provide quick and usable access to statistics and metrics, and correspondence of events in all relevant data sources.

User awareness and necessary training to understand and implement good cyber hygiene practices in SG. A culture of knowledge of cybersecurity must be established in the utilities. Cybersecurity and cyber hygiene recognition program depend on the environment of the organization, and the threat level [²⁴].

The cybersecurity and cyber hygiene training program must incorporate all the employees include the new ones. The modality could be In-person or online training. It is recommendable use tools such as Cyber Range [²⁵].

Some tools for incident detection and prevention are SIEM (Security Information Management and Events), and DLP (Data Loss Prevention) could be used as cyber hygiene tools. There is a lack of cyber hygiene tools to check and verify the own cyber hygiene practices of each actor.

Legal issues of cybersecurity and cyber hygiene, such as personal legal matters, corporate legal matters, and International law are imperative in SG. Another critical aspect to consider is the ethical issues in cybersecurity and cyber hygiene, for example, personal ethical issues and corporate ethical issues.

The next steps must be followed for employees and any person trying to avoid any legal and ethical issues. If the answers are no, the process ends 1. Is it legal? 2. Does this comply with our code of ethics, policies, and principles? 3. Am I sure that this will not cause loss or damage to our companies and their shareholders? 4. Would it be okay if everyone did it?

2.4 Cybersecurity, IT Governance and Risk Management Frameworks

There is a lack of cyber hygiene frameworks, but fortunately, there are a lot of frameworks to guarantee cybersecurity.

Some frameworks are derived of best practices of industry and IT Governance. Other relevant frameworks are related with risk manager. This section describes a review of the essential frameworks necessary to define a cyber hygiene methodology.

In the United States, the National Institute of Standards and Technologies (NIST), Center give some cybersecurity guidelines for computer security resources, Department of Homeland Security (NSA), Guides for security settings, and the common criteria standard [²⁶].

The NIST Cyber Security Framework [²⁷] is one of the most important frameworks for the SG, and it is composed of the following steps: identity, protect, detect, respond, and recover. In addition, NIST has other Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 [²⁸], which is composed of three parts: the core, tiers, and profile.

ISO 27000 [²⁹] is one of the most implement cybersecurity frameworks worldwide, and it is very suitable to implement in SG. ISO 27000 standard defines twelve cybersecurity domains: 1. Risk assessment, 2. Security policy, 3. Organization of computer security, 4. Asset management, 5. Security of human resources, 6. Physical and environmental security, 7. Operations and Communications Administration, 8. Acquisition, development, and maintenance of computer systems, 9. Access control, 10. Management of computer security incidents, 11. Business continuity management, and 12. Compliance.

Other best practice and IT governance frameworks are the Control Objectives for Information and related Technology (COBIT) [³⁰], the Information Technology Infrastructure Library (ITIL) [³¹], the Mexican Norm for Cybersecurity and IT Governance (MAAGTICSI in Spanish acronym) [³²], among others.

The National Initiative for Cybersecurity Education (NICE) defines the National Cybersecurity Workforce Framework [³³] consist of the following steps operate and maintain, protect and defend, investigate, collect and operate, analyze, supervision and development, and dispose of safely.

A useful framework for risk management is STRIDE (Spoofing Identity, Tampering with Data, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) proposed by Microsoft [³⁴]. STRIDE could improve the cybersecurity of diverse security objects that are shown in Table 5.

Other useful risk assessment methodology proposed by Microsoft is DREAD (Damage, Reproducibility, Exploitability, Affected Users, and Discoverability) [³⁵].

The cybersecurity baselines are a useful guideline for beginning policies and practices. The Microsoft Baseline Security Analyzer (MBSA) [³⁶] defines the following recommendations missing security updates, administrator accounts, simple or nonexistent blank passwords, firewall settings, incorrect security settings, management settings, unnecessary services, network exchanges, security event audit, status of temporary user accounts.

Another organization which define cybersecurity baseline for Web and Mobile apps is the Open Web Application Security Project (OWASP) [³⁷].

The OWASP Application Vulnerabilities are username enumeration, weak passwords, account lockout, lack of multi-factor authentication, insecure third-party components. The most popular exploits are firmware replacement, cloning, DoS, extraction of security parameters.

In addition, OWASP provide mobile applications most widely exposed vulnerabilities such as insecure communication, insecure data storage, insecure authentication, improper platform usage, insufficient cryptography, among others.

The OWASP Web and Cloud Application Vulnerabilities are injection, XML external entities (XXE), sensitive data exposure, broken access control, broken authentication, among others.

The Common Vulnerability Scoring System (CVSS) is a risk assessment framework [³⁸]. CVSS is composed of the following parts. 1.

Metric Group: Base Metric Group (Exploitability metrics [Attack Vectors, Attack Complexity, Privileges Required, User Interaction, Scope], Impact metrics [Confidentiality impact, Integrity impact, Availability Impact, Scope]), 2. Temporal Metric Group (Exploit Code Maturity, Remediation Level, Report Confidence), 3. Environmental Metric Group (Modified Base Metrics, Confidentiality Requirement, Integrity Requirement, and Availability Requirement).

Besides, the NIST defines the Risk Management Framework (RMF) [³⁹] composed of the following activities Risk Identification, Risk Assessment (Score, Weight, Prioritize risk), Risk Response Planning (Determine risk response, Plan actions), Response Implementation (Implement risk response), Monitor and Assess Results (Continuous risk monitoring and response evaluation).

3.1 Define Cybersecurity Framework

For the development of good cyber hygiene, it is necessary to have an adequate Information Security Management System (ISMS). The cybersecurity and IT governance frameworks are described in Section 2.4.

3.2 Do a Risk Analysis

The fundamental part of an ISMS is risk analysis, where each asset determines each main cybersecurity risk. It is necessary to evaluate the internal and external factors of the organization of each asset for developing a risk analysis. As well as the roles of those involved in the process Traditionally, risk analysis has focused on the threats and vulnerabilities part of information assets but has not considered business processes and related activities.

There are a lot of risk management and assessment frameworks (see Section 2.4). The authors define a simple risk analysis methodology to evaluate assets based on the three basic premises of cybersecurity: CIA reviewing the impact that each of them can cause. This risk methodology is optional and can be replaced by others. Bellow the simple risk management framework is shown. Table 6 shows how a score is assigned for each CIA security premises.

The different types of countermeasures and controls could mitigate risks or the absence of them must help to increase the risk.

For each asset, the threats, vulnerabilities, countermeasures and impacts are considering determining the risk for each CIA premises. The weighting results are given as the sum of the score of each premise. Table 7 shows the total score for risk assessment of an asset.

Risk management is so important but most important is Supply Chain Risk Management. The authors proposed a variation of Model Business Canvas (MBC) [⁴⁰] composed of the following activities: Key associations, Key activities, Key resources, Value propositions, Cost structure, Customer Relations, Channels, Customer follow-up, Recurring income. All this process could be helping to identify, analyze, and assess risks.

3.3 Identification of Business Process Flows and Their Relevance in Cybersecurity and Cyber Hygiene

In addition to risk analysis, it is necessary to visualize the resulting processes to determine risk factors and identify actors that allow them to carry out their activities. The previous steps using MBC could help in this process.

The most important thing in this part is the definition of set scenarios because we can identify, actors (people), processes, data, and objects used. This can help to determine other risks not shown in the risk management process.

3.4 Cyber Hygiene Practices and Operations

The next step in the proposed methodology is definition of polices and operations for cyber hygiene.

In this part, it is very important to define in what frequency should it be done the operations? And should it be done manually or automatically?

3.5 Cyber Hygiene Documentation

The last step in the methodology is to document all the incidents that occurred during the cyber hygiene operations. The recommend format to report the cybersecurity events must content Incident date, Short description of the incident, Number of victims, the impact (what was taken) and the most important, how activities I must be done in ones cyber hygiene operations to reduce this risk soon.

4.1 Using a Cybersecurity framework

The authors used the MAAGTIC framework due to is the official norm in Mexico, and our principal client in the future is the Mexican utility CFE (acronym in Spanish of Federal Electricity Commission).

4.2 Implementing a Risk Analysis

The authors used their own simple methodology for risk management to do the risk analysis. Table 8, 9, and 10 show an example of the risk analysis in SMS through Edge, Fog, and Cloud layers.

The parameters used in the risk analysis are Asset, Value (Impact), Threat, Vulnerability, Confidentiality, Integrity, Availability, Controls, and Risk. These parameters are common in risk analysis. Additionally, are include Delay Response and Remedy. The last two parameters express the time delay in response to a contingency and the action that must be implemented after contingence.

4.3 Identification of Business Pprocess Flows and Their Relevance in Cyber Hygiene

The primary business process flows used in the practical case for testing are describing below.

Scenario 1. The user/client reviews their consumption and billing history through the Web or mobile application. Others consist of displaying visual information.

Figure 3 shows the general case of this scenario. The readers can note all the failures points such as mobile and web apps (the responsible are the utility’s programmers), the Internet and other CN (responsible utility’s network administrators), web server, MDBS, and Billing (responsible utility’s sysadmin). The cyber hygiene operations in scenario one is related on each role of responsibility. For instance, programmers must be review and audit source code and must do pen-testing. Network admin must check firewall and router configurations. Sysadmin must check https and SSL certificates, check database integrity in MDBS and Billing databases, and do pen testing in all Webservices and API interconnections.

Fig. 3 Scenario 1: General connection using web or mobile apps 

A variation of scenario 1 implies that clients can pay their electricity consumption. For this subcase, clients must be authenticated in the web or mobile apps. The customer number and password will be required to access the apps, so it will be necessary for the user to build a secure and robust password, periodically the password must be changed in addition to not sharing it. Also, clients must store and protect their credit card information.

These activities are examples of cyber hygiene operations that clients must be done.

Figure 4 shows the scenario 1.1. Note that cyber hygiene roles are client, apps programmers, network administrators and bank systems administrators. Clients’ cyber hygiene are described in the paragraph above. Programmer must be implemented auditing in login process and notify any inconsistency. Also, programmers must implement a correct interconnection with bank systems. The bank systems programmers and IT personnel must protect the credit card information and store transaction safely.

Fig. 4 Scenario 1.1 Login in apps to pay to the bill 

Oher important scenario in SMS is data communication between SM, DC, and MDBS. Scenario 2 refers to consumption/production readings and events and alarms notification between. This scenario is shown in Figure 5. Note that there are five failure points: client, SM, CN, DC, and MDBS.

Fig. 5 Scenario 2 Data communication between SM and the utility 

The role of the client is checking the physical security of its SM. If the SM is broken or there are some electrical or electronics components altered, the client must communicate these classes of events to the utility. The SM and DC must be checked physical and logical cybersecurity for the OT employees’ utility.

The OT must report any inconsistency of physical components. Also, IT employees’ utility must check all the logical control such as encrypted data, firmware updates patched, embedded database backups, among others. The cyber hygiene operations in CN must be checked by the network administrators’ utility monitoring traffic, implementing perimetral security, among others. In addition, OT employees’ utility must check the physical cybersecurity of the means of communication like antennas, access points, and wired means.

Finally, sysadmin must check the cyber hygiene of MBDS doing operations like backups, checking data integrity, and check and monitor all the transactions between SM and DC with the MDBS.

4.4 Cyber Hygiene Policies and Operations

The authors made a literature review of the principal works form cyber hygiene cybersecurity [⁴¹-44] and general cybersecurity best practices to determine policies and operations of cyber hygiene. The list of policies and operation are shown in Table 11.

4.5 Cyber Hygiene Documentation

Table 12 shows the cyber hygiene documentation and logs registered in the testing process.