Increasing networking and digitalisation of systems means that the threat situation for IT/OT security is becoming more serious. The need for robust OT security practices (operational technology) is gaining in importance in order to minimise the risks of cyber threats. Cyber attacks are on the rise and have already led to significant interruptions to business operations, financial costs and reputational damage.
As a result, energy system operators are legally obliged to implement minimum IT security standards with specific requirements for increasing IT security. With the German “Act to increase the security of information technology systems (IT Security Act)”, a specific framework was created, which is further concretised and constantly being advanced.
The vgbe Conference “IT/OT Security in Energy Systems” offers an additional platform for vgbe members to exchange ideas with each other and with relevant experts from the energy industry and the waste disposal sector.
This platform was offered for the third time on November 21/22, 2023. Specific focal points were set that went beyond the agenda of the previous conference programmes. For example, the approximately 120 participants were given an insight into the requirements of the KRITIS (critical infrastructure) umbrella law and on the implications upon implementation of these requirements for an attack detection system in OT systems.
The companies in the electricity and heat supply and waste disposal sectors face the challenge of keeping track of current developments and reacting in good time to increased requirements. In particular, the transition from own unregulated (voluntary) activities for “KRITIS security” to the implementation of regulatory requirements is crucial, as this involves many formal stipulations. For example, proof, if necessary with certificates, is explicitly required and non-compliance can result in fines. It is important that industry experts influence on the legislator and regulators at an early stage in order to achieve the actual goal of improving security and resilience of energy systems. This overall target is not to be lost in a myriad of formal requirements. In this connection vgbe is working closely with BDEW (Federal Association of the German Energy and Water Industry) and other industry associations. In addition, vgbe is also a member of the electricity industry working group of the UP KRITIS and is thus in the position to represent its members´ interests.
The third vgbe IT/OT Conference focussed on the following topics:
- Threats and solutions for increasing IT/OT security
- Feasibility/pragmatic solutions for implementing regulatory requirements
- Sypply chain/supplier management
- Incident management
- Implementation deadlines and procedures for application of the new ISO 27001
- Systems for attack detection
- Management of reports from attack detection systems, flood of reports, future outlook systems for attack detection
- Security Operations Centre (SOC) as an in-house service or as an external service, characteristics and operator experience
- Software Bill of Materials (SBOM): detailed guide which, among other things, provides information about the components used in software. As a kind of parts list, an SBOM guide helps suppliers and buyers alike to maintain an overview of the components and improve the security of the software supply chain.
This year, the programme also broke new ground: In addition to a panel discussion on the “Characterisation of the Security Operations Centre”, two break-out sessions were held on the topics of “Systems for attack detection” and “Dealing with IT/OT security incidents”. Spontaneous teams analysed the topics from different perspectives and the results were summarised in a joint group discussion.
The eight exhibitors (manufacturers and service providers of IT/OT security services) were directly involved in the conference programme with their own presentations. Thanks to the logistical organisation of the exhibition, there was ample opportunity for intensive dialogue and successful networking during breaks.
Exhibitors
vgbe would like to express their gratitude and very special thanks to the conference moderator Andreas Jambor, RWE, who in his tried and tested manner brought expertise and pointedly controversial aspects to the discussion. In addition, Dr Swantje Westpfahl, Institute for Security and Safety, moderated the break-out sessions, a decisive part of the new format, which was very well received thanks to her thanks to her personal commitment.
vgbe would also like to thank all speakers, participants and exhibitors for their valuable contributions and discussions, which once again contributed significantly to the success of conference.
The venue and date of the 4th “IT-OT Security in Energy Systems” will be published in good time on the vgbe website and in the vgbe energy journal.
