Decentralization, Lack of Visibility & Targeted Attacks
With the decentralization of power supply, energy utilities, distribution system operators and transmission system operators face an increasingly fragmented infrastructure with a large number of remote locations and network users. Only extensive digitalization enables the efficient operation of these modern power grids and the operation of the smart grid and smart metering infrastructure.
However, it also increases the risk of vulnerabilities, attacks and technical error states. Distributed assets provide optimal access points for targeted attacks and the reconnaissance of the wider infrastructure.
At the same time, operators lack the visibility to effectively identify harmful changes at an early stage. This is especially true for remotely controlled assets such as substations, switchgear, and renewable energy plants, as well as affiliated municipal utilities.
Early Intrusion Detection System For The Entire Infrastructure
Energy supply companies can only protect what they can see. Established cybersecurity regulation and standards therefore recommend an end-to-end system defense-in-depth intrusion detection system. This must ensure that intrusion attempts are already identified and mitigated in the early phases of the attack.
Energy suppliers, distribution system operators and transmission system operators therefore need a system that creates complete visibility in their industrial control systems. Any change in the digital communication behavior within the plants' ICS and between the sites must be detected, documented and reported in real-time.
This enables operators in the control room to respond quickly and proactively to attacks and technical error states.
Holistic Cybersecurity From The Control Room To The Substation
Rhebo Industrial Protector non-intrusively monitors, analyzes and visualizes all assets and the complete data traffic within your ICS.
In real-time, the anomaly detection reports any changes in communication behavior, e.g.:
- new devices and network users;
- changed commands and functions of a device;
- critical activities such as firmware updates and changes in PLC operating modes;
- circumvention of security mechanisms by physical or virtual components;
- reconnaissance and intrusion activities such as network scans and lateral movements;
- known vulnerabilities of the devices;
- technical error conditions.
-
Success Story TEN
-
Guideline »The Norm IEC 62443 in Practice«
-
Success Story BayWa r.e.
Rhebo Industrial Protector can be integrated into the ICS as a hardware or software sensor. For cost-efficient monitoring of communication in distributed power infrastructure, the integration can be done on existing security gateways from e.g. Barracuda, Bosch Rexroth, INSYS icom, RAD, or Welotec.
The specific protocol types used in energy utility ICS such as OPC, IEC 60870-5-104, IEC 61850-8-1, DNP3 and their variants are fully supported.
Rhebo also supports you with the operation of Rhebo Industrial Protector. The ICS monitoring can be operated in-house and via Managed Services.
YOUR ADVANTAGE: You always have full clarity about potentially harmful communication processes in the ICS. You can react immediately to potential disturbances before the energy supply processes are affected.
-
Step 1: Cybersecurity Audit
-
Step 2: ICS Monitoring
-
Step 3: Managed Services
