  The growing adoption of Internet-of-Things (IoT)-enabled energy smart
appliances (ESAs) at the consumer end, such as smart heat pumps, electric
vehicle chargers, etc., is seen as key to enabling demand-side response (DSR)
services. However, these smart appliances are often poorly engineered from a
security point of view and present a new threat to power grid operations. They
may become convenient entry points for malicious parties to gain access to the
system and disrupt important grid operations by abruptly changing the demand.
Unlike utility-side and SCADA assets, ESAs are not monitored continuously due
to their large numbers and the lack of extensive monitoring infrastructure at
consumer sites. This article presents an in-depth analysis of the demand side
threats to power grid operations including (i) an overview of the
vulnerabilities in ESAs and the wider risk from the DSR ecosystem and (ii) key
factors influencing the attack impact on power grid operations. Finally, it
presents measures to improve the cyber-physical resilience of power grids,
putting them in the context of ongoing efforts from the industry and regulatory
bodies worldwide.
