Global 24/7 Cybersecurity For Renewable Energy Resources

at
BayWa r.e. Data Services GmbH
The BayWa r.e. AG designs, builds and operates wind farms and photovoltaic (PV) parks worldwide. 99 % of technical operations management, servicing and maintenance are carried out via remote access.

Network Intrusion Detection with Rhebo support

at
Stadtwerke Bochum Netz
Stadtwerke Bochum Holding has been a reliable supply partner for all Bochum residents since 1855. Today, Stadtwerke Bochum provides around 3,600 GWh of electricity and around 2,900 GWh of gas every year. It also provides water, district heating, telecommunications products, and solutions for the expansion of e-mobility. As a modern, customer-oriented company, Stadtwerke Bochum actively addresses the requirements and challenges of the times.

Verification of Network Segmentation at German Water Company

at
Waterworks Leipzig
The German water company Leipziger Wasserwerke (LWW) is a subsidiary of the Leipziger Gruppe. With 5 water plants, the company supplies 545,000 people in the Leipzig region with fresh and high-quality drinking water. It also treats 95,000 m³ of waste water per day in 25 sewage treatment plants.

Sabotage Investigation in Logistics Companies

at
Digital Forensics GmbH
Digital Forensics GmbH is a german company specializing in forensic analysis of large-volume network traffic in industry and insurance. The company evaluates cases of damage and analyses cyber attacks. Knowledge of industry-specific protocols such as Profinet, OPC, S7 or IEC61850 as well as their evaluation form a focal point of the work.

Secure Energy Supply For Over 1 Million People

at
Thüringer Energienetze GmbH & Co. KG
TEN Thüringer Energienetze is the largest distribution network operator in the German federal state of Thuringia. Its networks reliably supply more than 1.1 million people, the domestic economy and downstream distributors with energy. TEN provides all infrastructure services for the supply of electricity and natural gas, the connection of decentralized energy resources and, as part of its services, network operation for third parties.

Real-Time Security and Continuous Improvement Of Energy Supply

at
e-netz Südhessen AG
Anchored in Darmstadt, e-netz Südhessen AG, as a subsidiary of ENTEGA AG, takes care of the secure energy supply and the functioning infrastructure for around one million people in the region - from private households to municipal facilities, operators of solar systems and wind farms to industrial companies, scientific and research institutions.

Defense-in-Depth in the OT networks

at
MEGA, der Monheimer Elektrizitäts- und Gasversorgung GmbH
As a municipal energy supplier and innovative service provider, MEGA is as much a part of Monheim as the Rhine. Personally and locally, we create a warm, bright home for the people of Monheim with a fast digital window to the world. For over 100 years, we have been helping to make Monheim am Rhein a livable and attractive city - for families and companies.

Ensuring ICS Cybersecurity of Energy Providers

at
EWR Netz GmbH
In addition to its core business as a public network operator for electricity, gas and water, EWR Netz GmbH offers many different services with its qualified employees and extensive technical equipment. Regional network operators such as EWR Netz GmbH play an important role in the energy transition, as renewable energies and decentralized generation plants are feeding more and more electricity into the networks.

Intrusion Detection & Mitigation

at
sonnen GmbH
Since 2018, Sonnen GmbH has been the first and so far only provider in Germany to connect private home storage systems to form a virtual power plant. Sonnen GmbH is building an energy system that provides clean electricity at exactly the right time and where it is needed. A system that enables cost benefits for everyone while relieving the strain on the power grid. In addition, the sonnenVPP plays an important role in the energy transition. By stabilizing the energy grids on three continents, the company is ensuring that more and more renewable energies can be connected to the grid, thus accelerating the transition to clean energy.

Falk Fischer

Team Leader IT-Systems and Applications
|
Waterworks Leipzig
»The audit has given us a clearer picture of all processes in our complex industrial control system. This enabled us to analyze all communication traffic extensively and check the ICS specifically for vulnerabilities. We were impressed by the smooth process. The direct development of effective measures optimally prepared us for future cyber security risks.«
To story download

Details

Initial situation and challenge

The German water company Leipziger Wasserwerke (LWW) is a subsidiary of the Leipziger Gruppe. With 5 water plants, the company supplies 545,000 people in the Leipzig region with fresh and high-quality drinking water. It also treats 95,000 mÑ of waste water per day in 25 sewage treatment plants. In addition to the secure and sustainable supply to the population of Leipzig, the protection of the sensitive waters of Leipzig is at the centre of its daily activities. For example, the LWW was able to reduce the amount of mixed water discharged into the natural waters by 30% via a modern sewer ICS for the 2,800 km long sewer network. As a modern company, LWW actively accepts the challenges of digitalization for security of supply. As part of the implementation of an ICS security concept, the information technology infrastructure was modernized. In order to establish a high level of security, the office IT and ICS were separated and additionally protected by demilitarized zones and other measures. For this purpose, a Rhebo Industry 4.0 Stability and Security Audit was carried out. Three aspects were in the spotlight:

ICS Assets Inventory

Identify all active components in the ICS for a complete asset inventory, and analyze their properties such as firmware version, manufacturer and identifier.

Communication Analysis

Visualize the connections of the ICS components among each other as well as to the office IT in a network map, and analyze them with regards to volume, type, function and content.

Detection and Mitigation of Vulnerabilities

Investigate the monitoring results for known vulnerabilities (according to Common Vulnerability & Exploits, CVE) and develop specific mitigation measures.

Solution

RISIK ANALYSIS

Rhebo Industry 4.0 Stability and Security Audit

  • Analysis of assets and communication structures using Rhebo Industrial Protector;
  • Identification of threats, vulnerabilities and technical error states;
  • Risk assessment;
  • Definition of mitigation measures.

ICS MONITORING WITH ANOMALY DETECTION

Rhebo Industrial Protector

  • Continuously ICS monitoring;
  • Identification of cyber attacks, vulnerabilities, malware and error states in real-time;
  • Analysis, evaluation and processing of incidents;
  • Compliance with industry standards and regulatory requirements.

Implementation and findings

The Rhebo Industry 4.0 Stability and Security Audit was carried out by the IT consulting company Softline Solutions GmbH at the client’s site. For the audit, non-intrusive sensors were integrated at neuralgic points of the LWW ICS in order to capture the entire communication. The integration took place via existing ports. Subsequently, all communication processes in the ICS were passively recorded over a period of two weeks. After completion of the data collection, Rhebo analyzed the data and summarized the results in a comprehensive report. The results were evaluated and concrete recommendations for action were developed in the concluding workshop under the guidance of Softline Solutions GmbH.

  1. The network map indexes all assets in the ICS with their properties and connections.
  2. For each host, details such as throughput, protocols, connections, communications, and anomalies are displayed in real-time.
  3. Rhebo Industrial Protector also reports insecure operations such as scans, unencrypted passwords and failed logins.

Results

COMPLETE TRANSPARENCY

of the ICS structure and processes established.

PROPERTIES OF ASSETS AND CONNECTIONS

nalyzed in detail.

INTEGRITY AND SECURITY

of devices and systems in the ICS verified.

ALL ASSETS AND CONNECTIONS

identified.

CONNECTIONS

between ICS and enterprise IT identified.

SEGMENTATION AND SYSTEM HARDENING

implemented through detailed risk analysis.

Also interesting