Test
Inverter Security Assessments & Lessons Learned
Executive Summary
Recent assessment activities identified recurring cybersecurity and operational risks associated with inverter deployments, including undocumented communications capabilities, insecure default configurations, hidden connectivity, and limited asset visibility.[2]
As Inverter-Based Resources (IBRs) and Battery Energy Storage Systems (BESS) continue to expand across the electric grid, understanding device communications, vendor access pathways, and security configurations has become increasingly important for both cybersecurity and reliability programs.[3]
Industry assessments have demonstrated that deployed systems may not always align with documented architectures or operational assumptions, highlighting the importance of validating technology deployments throughout the asset lifecycle.[4]
| Area | Potential Impact |
|---|---|
| Visibility | Undocumented communications capabilities may reduce awareness of how assets communicate and operate. |
| Cybersecurity | Default credentials, exposed services, and unmanaged access pathways increase cyber risk. |
| Reliability | Unverified configurations and unexpected connectivity may introduce operational uncertainty. |
| Supply Chain Assurance | Hidden components and communications pathways can complicate supplier validation and asset trust decisions. |
|
Assessment activities consistently demonstrate that organizations should validate hardware, communications pathways, software services, and security configurations through independent testing rather than relying exclusively on vendor documentation or deployment assumptions.[5] |
Assessment Overview
Assessment activities focused on understanding communications pathways, device configurations, software services, hardware components, and external connectivity associated with inverter deployments.[6]
The objective was not only to identify vulnerabilities, but also to validate assumptions regarding connectivity, architecture, vendor access, and operational behavior.[7]
Findings repeatedly demonstrated the importance of independent validation throughout procurement, commissioning, and operational lifecycle activities.
Key Findings
Undocumented Communications Capabilities
Recent EPRI assessments have highlighted the importance of understanding communications protocols, data flows, and connectivity that may not be fully understood or documented by system owners and operators.[8]
Examples observed during assessment activities included:
- Undocumented 868 MHz communications
- Undocumented 900 MHz communications
- Wireless interfaces not reflected within deployment documentation
- Unexpected communications pathways
- Communications behavior not represented in architecture diagrams
Why It Matters
Utilities frequently develop network architectures, monitoring strategies, and incident response plans based on expected communications behavior. Undocumented communications can create blind spots that reduce visibility and complicate operational awareness.
Hidden Cellular Connectivity
Assessment activities identified embedded cellular communications capabilities within inverter systems.
Examples included:
- Quectel BG95-M1 LTE modems
- SIM card-enabled communications modules
- ESP32 microcontrollers supporting communications functions
- Devices attempting cellular communications
The presence of embedded communications modules demonstrates the importance of validating hardware configurations and independently assessing communications capabilities rather than relying solely on deployment documentation.[9]
| Question | Objective |
|---|---|
| Does the device contain cellular hardware? | Validate communications capabilities. |
| Is a SIM card installed? | Determine whether external connectivity is enabled. |
| Can cellular functionality be disabled? | Reduce unnecessary attack surface. |
| Is connectivity documented by the vendor? | Verify deployment assumptions. |
Why It Matters
Cellular connectivity may introduce communications pathways that bypass traditional network monitoring, segmentation, and access control mechanisms. Organizations should understand where cellular communications exist, who manages connectivity, and whether functionality is required for operational purposes.
Configuration Weaknesses
Configuration reviews identified several conditions commonly associated with increased cyber risk and expanded attack surfaces.[10]
Examples included:
- Default passwords remaining enabled
- SSH services enabled
- Open MongoDB services
- Open NTP services
- External DNS configurations
- Unnecessary management interfaces
Why It Matters
Many of these findings can be addressed through secure deployment standards, commissioning procedures, and security validation activities. However, they continue to be observed across both new and existing deployments.
Organizations should assume default configurations require review and hardening rather than assuming systems are delivered securely configured.
Lessons Learned
Trust Must Be Verified
Manufacturer documentation, deployment assumptions, and expected architectures should be independently validated through technical assessment activities.
EPRI assessment methodologies emphasize understanding architecture, communications pathways, and attack surfaces as part of secure deployment reviews.[11]
The existence of undocumented hardware, communications capabilities, and software services demonstrates the importance of verification-based security programs.
Visibility Is Foundational
Organizations cannot effectively secure technologies they cannot fully inventory or observe.
Maintaining visibility into assets, protocols, communications paths, firmware versions, and external connectivity should be considered a foundational cybersecurity capability.[12]
Secure Configuration Matters
Default credentials, exposed management services, and unnecessary communications pathways continue to represent common sources of cyber risk.
Security controls should be reviewed and validated during deployment rather than deferred until systems are operational.
Lifecycle Risk Extends Beyond Deployment
Supply chain risk does not end after procurement.
Organizations should continuously evaluate firmware, software, communications pathways, and vendor access throughout the lifecycle of deployed technologies.[13]
Recommended Practices
Industry guidance increasingly emphasizes secure-by-design deployment approaches, architecture validation, communications awareness, and continuous monitoring throughout the asset lifecycle.[14]
| Focus Area | Recommended Practices |
|---|---|
| Asset Validation | Conduct physical inspections and validate deployed hardware inventories. |
| Wireless Assessment | Perform spectrum analysis and identify undocumented wireless communications. |
| Secure Configuration | Remove default credentials, disable unnecessary services, and implement secure baselines. |
| Architecture Review | Validate communications pathways and review remote-access capabilities. |
| Monitoring | Deploy network monitoring, OT visibility platforms, IDS capabilities, and continuous asset discovery. |
| Security Testing | Conduct periodic penetration testing, red-team exercises, and architecture assessments. |
Questions for Utilities
Organizations evaluating inverter deployments should consider the following:
- Do deployed assets match vendor documentation?
- Are all communications pathways understood and documented?
- Can wireless and cellular capabilities be independently validated?
- Are vendor remote-access capabilities required and controlled?
- Are secure configuration standards consistently applied?
- Are firmware versions regularly reviewed and updated?
- Can unexpected communications behavior be detected and investigated?
References
- ↑ EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- ↑ EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- ↑ EPRI Inverter-Based Resources and Grid Interconnection Research Area
- ↑ EPRI Supply Chain Assessment Research Program
- ↑ EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- ↑ EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- ↑ EPRI Technical Assessment Methodology (3002012752)
- ↑ EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- ↑ EPRI Supply Chain Assessment Research Program
- ↑ EPRI Technical Assessment Methodology (3002012752)
- ↑ EPRI Technical Assessment Methodology (3002012752)
- ↑ EPRI Defensible Network Architectures: Criteria for Secure OT Deployment in Power Systems (3002027430)
- ↑ EPRI Supply Chain Assessment Research Program
- ↑ EPRI Defensible Network Architectures: Criteria for Secure OT Deployment in Power Systems (3002027430)
EPRI Resources
- EPRI Security Design Architecture Review: Solar Inverters (3002029720)
- EPRI Supply Chain Assessment Research Program
- EPRI Technical Assessment Methodology (3002012752)
- EPRI Defensible Network Architectures: Criteria for Secure OT Deployment in Power Systems (3002027430)
- EPRI Inverter-Based Resources and Grid Interconnection Research Area
Related Topics
- Inverter-Based Resources (IBRs)
- Battery Energy Storage Systems (BESS)
- Supply Chain Security
- OT Asset Visibility
- Operational Technology (OT) Security
- Secure Architecture Reviews
- Grid Modernization
- Network Monitoring & Detection
- Supply Chain Risk Management
- Cyber-Informed Engineering