  The digitization and decentralization of the electric power grid are key
thrusts for an economically and environmentally sustainable future. Towards
this goal, distributed energy resources (DER), including rooftop solar panels,
battery storage, electric vehicles, etc., are becoming ubiquitous in power
systems. Power utilities benefit from DERs as they minimize operational costs;
at the same time, DERs grant users and aggregators control over the power they
produce and consume. DERs are interconnected, interoperable, and support
remotely controllable features, thus, their cybersecurity is of cardinal
importance. DER communication dependencies and the diversity of DER
architectures widen the threat surface and aggravate the cybersecurity posture
of power systems. In this work, we focus on security oversights that reside in
the cyber and physical layers of DERs and can jeopardize grid operations.
Existing works have underlined the impact of cyberattacks targeting DER assets,
however, they either focus on specific system components (e.g., communication
protocols), do not consider the mission-critical objectives of DERs, or neglect
the adversarial perspective (e.g., adversary/attack models) altogether. To
address these omissions, we comprehensively analyze adversarial capabilities
and objectives when manipulating DER assets, and then present how protocol and
device-level vulnerabilities can materialize into cyberattacks impacting power
system operations. Finally, we provide mitigation strategies to thwart
adversaries and directions for future DER cybersecurity research.
