Critical Infrastructures (CIs) are sensible targets. They could be physically damaged by natural or human actions, causing service disruptions, economic losses, and, in some extreme cases, harm to people. They, therefore, need a high level of protection against possible unintentional and intentional events. In this paper, we show a logical architecture that exploits information from both physical and cybersecurity systems to improve the overall security in a power plant scenario. We propose a Machine Learning (ML)-based anomaly detection approach to detect possible anomaly events by jointly correlating data related to both the physical and cyber domains. The performance evaluation showed encouraging results—obtained by different ML algorithms—which highlights how our proposed approach is able to detect possible abnormal situations that could not have been detected by using only information from either the physical or cyber domain.

Microgrids are growing in importance in the Smart Grid paradigm for power systems. Microgrid security is becoming crucial since these systems increasingly rely on information and communication technologies. Many technologies have been proposed in the last few years for the protection of industrial control systems, ranging from cryptography, network security, security monitoring systems, and innovative control strategies resilient to cyber-attacks. Still, electrical systems and microgrids present their own peculiarities, and some effort has to be put forth to apply cyber-protection technologies in the electrical sector. In the present work, we discuss the latest advancements and research trends in the field of microgrid cybersecurity in a tutorial form.

Distributed Energy Resources (DERs) are growing in importance Power Systems. Battery Electrical Storage Systems (BESS) represent fundamental tools in order to balance the unpredictable power production of some Renewable Energy Sources (RES). Nevertheless, BESS are usually remotely controlled by SCADA systems, so they are prone to cyberattacks. This paper analyzes the vulnerabilities of BESS and proposes an anomaly detection algorithm that, by observing the physical behavior of the system, aims to promptly detect dangerous working conditions by exploiting the capabilities of a particular neural network architecture called the autoencoder. The results show the performance of the proposed approach with respect to the traditional One Class Support Vector Machine algorithm.

The large spread of Distributed Energy Resources (DERs) and the related cyber-security issues introduce the need for monitoring. The proposed work focuses on an anomaly detection strategy based on the physical behavior of the industrial process. The algorithm extracts some measures of the physical parameters of the system and processes them with a neural network architecture called autoencoder in order to build a classifier making decisions about the behavior of the system and detecting possible cyber-attacks or faults. The results are quite promising for a practical application in real systems.

The increasing digitalization of power systems has revolutionized the functionality and efficiency of electrical protection relays. These digital relays enhance fault detection, monitoring, and response mechanisms, ensuring the reliability and stability of power networks. However, their connectivity and reliance on communication protocols introduce significant cybersecurity risks, making them potential targets for malicious attacks. Cyber threats against digital protection relays can lead to severe consequences, including cascading failures, equipment damage, and compromised grid security. This paper presents a comprehensive review of cybersecurity challenges in digital electrical protection relays, focusing on four key areas: (1) a taxonomy of cyber attack models targeting protection relays, (2) the associated risks and their potential impact on power systems, (3) existing mitigation strategies to enhance relay security, and (4) future research directions to strengthen resilience against cyber threats.

Cyberattacks targeting industrial control systems can produce environmental damage by disrupting energy production, altering chemical processes, or forcing reliance on more carbon-intensive backup resources. Yet, the environmental dimension of cybersecurity risk is rarely quantified. This paper examines the connection between cybersecurity and sustainability by comparing the environmental impact of cyber-induced power plant disruption with the life cycle emissions involved in deploying cybersecurity monitoring solutions. We present a quantitative scenario in which a cyberattack forces a temporary disconnection of a power generation unit from the grid, leading to additional CO₂ emissions primarily from wasted fuel during the operational disruption and subsequent reconnection procedures. The resulting carbon footprint is then compared with the emissions associated with implementing a continuous monitoring system designed to prevent such incidents. The results demonstrate that the installation and operation of a continuous monitoring system has a negligible environmental impact (below 5 tCO₂ over five years) compared to the emissions resulting from a single 12 h outage event (460–836 tCO₂), even when considering only the direct fuel waste. These findings position cybersecurity investment as a climate-positive strategy for the energy sector.