Monheim Elektrizitäts- und Gasversorgung GmbH, or MEGA for short, is the municipal energy and multimedia service provider for the town of Monheim am Rhein, Germany. For more than 100 years, the company with around 130 employees has been working to make Monheim am Rhein an attractive town worth living in for both families and businesses. This also includes a modern energy infrastructure with its own substation, hundreds of intelligent local stations and decentralized energy generation, such as the tenant electricity project in the Berlin quarter of Monheim am Rhein. For MEGA, automation and cyber security of the energy supply go hand in hand. Since 2015, the company has been operating a comprehensive information security management system (ISMS) in accordance with ISO 27001 and has been protecting its critical infrastructure according to the latest standards. The operational technology (OT) runs as an air-gapped solution with its own fiber optic network, sophisticated segmentation and multi-factor authentication in order to control access to sensitive industrial processes in the best possible way. Following the advice of the ISO 27001 auditors, an OT monitoring system was to be added to the security structure in 2023 to include an alarm and intrusion detection system that both detects successful attacks and unsolicited external access (e.g. via stolen credentials) at an early stage, and continuously checks the effectivness of the existing perimeter security.

OT RISK ANALYSIS AND VULNERABILITY ASSESSMENT

Rhebo Industrial Security Assessment

• analyze assets and communication structures,
• identify vulnerabilities and security gaps,
• define measures for system hardening.

‍

OT NETWORK INTRUSION DETECTION SYSTEM

Rhebo Industrial Protector

• continuously monitor the OT network communication,
• identify and analyze cyberattacks, security vulnerabilities, malware, and error states in real time.

‍

ON-DEMAND OT SECURITY SUPPORT

Rhebo Managed Protection

• conduct periodic vulnerability assessments,
• regularly evaluate identified anomalies with Rhebo experts,
• get emergency support.

In the search for an OT monitoring solution, ISMS coordinator Mirko Juranic trusted like-minded people. He spoke to various municipal utilities, which are also network operators, about their challenges and experiences with OT monitoring solutions. This also sharpened the requirements specification for MEGA: OT monitoring needed to be easy to integrate and independent of the grid control technology vendor. In addition, due to the existing shortage of specialists, active support was required for implementation, operation and forensics. The aim was and is both to relieve the burden on personnel, and to ensure knowledge transfer to build internal expertise on the subject of OT security through hands-on expert support. Following the initial vulnerability assessment and risk analysis of the OT networks by the Rhebo cyber security analysts, the network- based intrusion detection system Rhebo Industrial Protector was integrated into both the operational and redundant OT networks of MEGA. This ensures that communication from and between the several hundred local stations is continuously monitored for anomalies and conspicuous incidents. Already, various vulnerabilities were identified and eliminated in the first few weeks. These included outdated protocols and firmware versions as well as compromising factory settings on OT components. In addition, the ISMS coordinator and his team now have clarity at all times about how heavily the OT networks are used at specific times and where capacity bottlenecks occur.