As a wholly owned subsidiary of the enviaM Group, envia TEL is active in fiber rollout and data center operation and employs around 250 people. Since 2022, the company has been hosting the German internet exchange DE-CIX Leipzig at its data center campus in Leipzig, which connects the metropolitan region of Central Germany to the World Wide Web more closely than ever before. However, private customers and commercial enterprises can also use the data centers, which currently provide 3,000 mÇ of space (set to increase to 5,000 mÇ from 2025), to securely manage their data and host services. The data centers fall under the German Critical Infrastructure regulations and are subject to special security requirements for the early detection of cyberattacks and to avoid disruptions to critical infrastructure. This also includes the cybersecurity of the building automation systems. The building control system not only supplies the tens of thousands of servers with power and cooling, but also secures access to the data centers and ensures fire protection. As part of the necessary certifications according to ISO 27001, DIN EN 50600, and in accordance with the TÜViT criteria catalog, Rhebo’s OT monitoring with anomaly detection was deployed in October 2022.

RISK ANALYSIS AND VULNERABILITY ASSESSMENT

Rhebo Industrial Security Assessment

• Analyze assets and communication structures
• Identify vulnerabilities and security gaps
• Define measures for system hardening

‍

INTRUSION DETECTION SYSTEM FOR THE OT

Rhebo Industrial Protector

• Continuously monitor building control system communication
• Identify and analyze cyberattacks, security gaps, malware, and error conditions in real time

‍

MANAGED OPERATION OF THE SECURITY SOLUTION

Rhebo Managed Protection

• Conduct regular vulnerability assessments
• Regularly evaluate reported anomalies with Rhebo experts
• Get emergency support

In October 2022, Rhebo carried out its first Rhebo Industrial Security Assessment of data centers 1 and 2 of envia TEL. This created full visibility across all systems and connections in the control system that are crucial for a sustainable asset management and security concept. It also brought unfavorable configurations and security risks to light which then could be directly addressed. These included the cyber hygiene of service companies as well as legacy systems and problems with systems that send data to the outside world. The Intrusion Detection System Rhebo Industrial Protector installed in the control system went into continuous operation after initial baselining. It has since monitored communication within the building management control system 24/7. In the first year, OT monitoring enabled the security team to eliminate unencrypted communications, localize unreachable services, and identify outdated operating systems, firmware, and protocols that pose a security risk. For more complex issues, envia TEL can rely on Rhebo's expertise by discussing critical or unclear anomalies in detail in regular meetings. This allows the security team to bridge the prevailing skills gap and continually expand its knowledge on OT security.