These processes address more than
data transfer and data privacy; they
also look at specic products.
“When we produce a piece of hard-
ware that includes electronics and
software, and the hardware has to be
transported to a customer site, you
have to test the equipment in the fac-
tory and again on-site after deploy-
ment. It’s important to secure the en-
tire supply chain before installation
on the site in such a way that the sys-
tem itself cannot be manipulated,”
said Dr. Wunschik. “Almost all sys-
tems in the energy industry have a
physical attack surface, which can
affect IT security, and vice versa
where IT vulnerability can take a
physical dimension at a customer
site.”
Dr. Wunschik explained: “Take a
simple switch to be used at a data
centre, for example. You order the
switch from anywhere in the world,
install it and expect it to work cor-
rectly. But during maintenance, the
engineer might notice additional
chips on the switch. Were they put on
the motherboard after the initial pro-
duction process? I have seen this
happen whereby a manufacturer
added components to block some
functionality on the switch in order to
sell it at a lower price. But do you re-
ally know what these chips are doing
without having tested?”
It is therefore imperative that the
entire chain is secure – that includes
vendors like Siemens Energy, its sup-
pliers, as well as the customer site. As
Dr. Wunschik put it: “Cyber security
is a team sport. You cannot do it only
from your own point of view; you
need partners with the same security
level or at least the same awareness of
the topic.”
Siemens Energy has a dedicated
“ProductCERT” team in place that
manages all security-related issues in
Siemens Energy products, solutions,
and services. ProductCERT coordi-
nates and maintains communication
with all involved internal and exter-
nal parties to quickly and effectively
respond to security issues. Security
Advisories are issued to inform cus-
tomers about measures that must be
taken to securely operate Siemens
Energy products and solutions.
The company has offered power
plant operators in the UK penetration
testing – not as a typical IT vendor
but as an energy company for IT and
OT issues at the site. Here, Siemens
Energy experts act as external hack-
ers to test systems and products for
vulnerabilities.
While a number of energy compa-
nies are quite mature in terms of cyber
security strategy, Dr. Wunschik be-
lieves some need to leverage the
community effort to deploy technolo-
gies and processes and apply similar
approaches from the IT side to the
energy grid. She says this is where
Siemens Energy can help but noted
that the level of what is needed varies
from place to place.
“There are specic regions in the
world where the government is very
active in monitoring the energy grid
and they are looking at how trans-
mission and distribution operators
are working together to look for
anomalies in the system to assess
A
s digitalisation spreads through
the electricity sector and a
growing number of companies
move data into the cloud, cyber-
attacks are on the rise. For critical
infrastructure like electricity, water
and gas, the consequences of a
successful cyber-attack can be
disastrous. The attack on the Colonial
Pipeline in May was a very public
reminder.
Fortunately, regulators are becom-
ing increasingly active in tackling
the problem. Following the Colonial
Pipeline incident, US lawmakers
joined forces in a bipartisan bill that
would direct the Cyber security and
Infrastructure Security Agency
(CISA) to create a special cyber
programme to test the nation’s criti-
cal infrastructure defences.
It is a step in the right direction but
the scale of the problem cannot be
underestimated.
Dr. Judith Wunschik, Global Cyber
Security Chief at Siemens Energy,
outlined how Siemens Energy is pre-
paring itself for the challenges ahead.
Having grown her cyber security ex-
pertise in the banking sector, she was
able to offer an interesting perspective
on the threat facing the energy sector.
“I have a physics background but
switched over to cyber security in
2013 for ING Bank. Joining what was
then Siemens Gas and Power in 2019
was a challenge and opportunity to
see cyber security from a different
viewpoint. Banks have been doing
this for a long time, and a lot of the
cyber principles from the banking
sector can be transferred [to the
power industry]. At the end of the day,
an IT system is an IT system, and if
someone tries to attack a weak point
on a chip, it makes little difference if
the computer is in the data centre of a
bank or in the data centre of a utility
operator, or on the site of the utility
itself.”
She noted that when considering the
IT/OT (operational technology) con-
vergence in the energy sector,
whether at in-house manufacturing
sites or utility installations, processes
have to be modied but core principles
remain the same. “Processes [in the
energy sector] have to be adapted to
more locally managed, non-redundant
systems and there are a lot more lay-
ers to the operation. But it’s still asset
management. Also, crisis manage-
ment and communication is a core
process for any cyber security ofcer
regardless of the business itself.”
She also said the adversaries in the
two sectors are comparable: they
could be hackers looking to extort
money; ‘hacktivists’, looking to
cause reputational damage; or nation-
state actors that are politically moti-
vated to compromise systems.
Essentially, years of experience
have taught Dr. Wunschik that regard-
less of the sector, every connected
product or solution can be attacked.
Coming into the energy sector, her
rst task was to secure the solutions
and processes of Siemens Energy.
“When you look at the digital envi-
ronment from a Siemens Energy
point of view, there are the internal
assets – all the IT for our daily busi-
ness, laptops, mobiles, applications,
servers, etc. – the data and informa-
tion assets of the company and its
customers, all the product specics
and the intellectual property as well as
the digital components of the products
itself; and last but not least the solu-
tions and services we supply as a
full-service offering to the customer.
As a cyber security ofcer in energy,
your universe is much broader com-
pared to a digital product realm.”
During her rst year as global cyber
security ofcer, Dr. Wunschik’s main
task was to ensure the security of the
newly spun-off Siemens Energy –
keeping the licences to operate exist-
ing processes within Siemens and
transferring them to the independent
company. Now it is a case of ramping
up the cyber security capabilities
across the new organisation.
“With more than 90 000 employees
around the globe, we always joke that
we are the largest global start-up ever.
This year we are now looking at the
processes to see what can be done
leaner with a higher degree on auto-
mation,” said Dr. Wunschik. “The
product departments within Siemens
Energy are quite mature already and
there are a lot of principles in place.
We are currently looking at more
standardised working from an over-
sight perspective to bring the same
standards to all departments. That
also helps our customers from an in-
dustry perspective.
“But the biggest focus is to build our
energy business of tomorrow with
products and solutions that evolve
with changing threat landscapes to
continuously meet the highest cyber
security standards.”
As an example, she cites the com-
pany’s recent receipt of ‘Cyber Es-
sentials Plus’ certication across
Great Britain and Ireland (see box).
This certication is essential for bid-
ding for critical national infrastructure
projects but will also support Siemens
Energy’s R&D, lifecycle and supply
chain processes.
Dr. Wunschik: “It is
imperative that the entire
chain is secure – that
includes vendors like
Siemens Energy, its
suppliers, as well as the
customer site”
Energising cyber security
Following its spin-off almost a year ago, Siemens Energy is transferring its cyber security processes to the new
organisation. Junior Isles hears what this has meant for the company and its customers, and discusses the growing
cyber threat to the energy sector.
Special Technology Supplement
THE ENERGY INDUSTRY TIMES - JULY 2021
10
where rst attacks might come from.
But there is a huge difference in ma-
turity around the globe.
“As a global vendor, you have to be
able to tackle the needs of the region. If
you look at mobile IT devices, for ex-
ample, there are regions in which you
can use the device itself as a trusted
factor; but there are others where you
can’t. When you are looking to re-
motely monitor plants or grids you
have to consider whether you send out
a eld engineer with their own device.
The industry needs to mature much
more from the perspective of trusted
identities and processes.”
Certainly, the energy industry has
challenges ahead in the world of cy-
ber, with perhaps the main one being
the increasing number of threats and
attacks on old vulnerabilities.
“There are growing attacks on IT
infrastructure. If you look at the attack
on the Colonial Pipeline in the US, it
was not an attack on the OT [infra-
structure] of the pipeline, i.e. the op-
erational technology. It was an attack
on the nancial systems of the enter-
prise, which caused Colonial to take
the decision to shut down the pipeline.
So the reputational and nancial dam-
age was caused by attacking a classi-
cal IT system,” said Dr. Wunschik.
“This is why you have to look at the
entire digital landscape and ask where
an attacker can come in – he will al-
ways step in at the weakest link in the
chain.”
Similar vulnerabilities can arise
from eld service engineers using old
systems or unchecked devices such as
USB sticks.
“The pandemic has increased the
distribution of your end-points, from
an ofce point of view, across the in-
ternet,” said Dr. Wunschik. “Compa-
nies that were not ready, having previ-
ously worked only in closed ofce
networks without a transparent asset
and identity management concept,
failed immediately,” said Dr. Wun-
schik. “From an energy company/
utility view, although direct attacks on
the generation and transmission busi-
ness did not change, adversaries found
there was a growing environment to
hack connections via the internet. At
Siemens Energy, we have seen the
level of attacks grow signicantly. But
we were prepared, supported by ma-
ture technologies and processes that
we could scale up to securely meet the
increased demands. All ofce em-
ployees were equipped with laptops,
and IT infrastructure performance was
available on broad scale.”
Unfortunately, small and medium-
sized enterprises are often not so pre-
pared and social engineering, i.e.
changing social behaviour around cy-
ber security, remains a key issue as
more employees work from home.
Looking past the pandemic, in the
immediate future Siemens Energy
will continue to support utilities in
securing the entire ecosystem – not
just specic parts, such as nancial
systems or scada systems but to secure
and create protection concepts from a
threat perspective. This requires more
than equipment and software; it also
requires people.
One of the main challenges that Dr.
Wunschik sees for the next 5-10 years
is talent. “We need to nd the people
that are ready to step into these cyber
security positions. A lot of enterprises
are relying on software vendor prom-
ises. Energy utilities have to adapt the
secure solutions they are offering, so
you still need knowledge. So the ques-
tion for the next ve or ten years from
a cyber management perspective
should be how to share resources
across the industry.”
Summing up, she said: “I’m always
asked who will pay for all of this? But
cyber has to become a USP for the
vendors as well as the [energy] com-
panies. It is fundamental to securing
our society overall.”
According to a recent report by global data
protection company Veritas Technologies,
just over half of UK utilities have fallen victim
to a cyber-attack in the last year. But despite
the sector’s vulnerability to cyber-attacks, it
is pressing ahead with its move to the cloud.
The research found that, on average, utility
companies have 48 per cent of their business
data stored in the cloud. In the next ve years,
this is set to grow to 60 per cent.
It is a trend that will keep John Cornelius
busy for the foreseeable future. As Siemens
Energy’s Senior Cyber Security Ofcer (CSO)
UK&I and “the face” of cyber for the company
in the UK and Ireland, Cornelius is the rst
point of contact in supporting Siemens Energy
business units and their customers in their
efforts to keep their organisations and the na-
tion’s energy infrastructure safe and secure.
“Attacks on energy infrastructure and indus-
trial facilities unfortunately happen every day.
The differences are not specic to regions but
depend on the nature of the different threat
actors and their individual motivation – which
might be publicity, monetary interests, political
revenge or blackmailing,” he said. “The indus-
try is shifting away from on-premise solutions
to cloud-hosting solutions. The risks that go
with that are an increased potential for attacks
aimed at manipulating or stealing data. A big
part of my role is to understand the potential
impact of someone getting hold of Siemens
Energy data, and protecting it in line with cor-
porate requirements to the best of everyone’s
ability.”
According to Cornelius, activities to provide
this protection include:
n Critical Asset identication – what is the
most important data for Siemens Energy and
how to protect it
n ‘Exception management’ – mitigating risks
if a business is unable to comply with policy
and making sure everything is transparent
n Vulnerability management – taking care of
internal IT vulnerability management aspects
and supporting the company’s “Product and
Solution Security team” in detecting vulner-
abilities in the lifecycle management
n Training and awareness, e.g. as part
of the Siemens Energy-wide Cyber security
Ambassador community that helps local man-
agement to apply cyber-secure work practices
and improve the company’s overall resilience.
This last point is of particular importance in
an environment where more staff are working
from home. But the training and awareness
programme has paid off.
“When everyone started working from home
at around the end of February last year, I was
very concerned the amount of cyber security
issues would go through the roof,” said Corne-
lius. “I thought there would be compromised
credentials, people clicking on links in emails,
etc., but every single employee stepped up
their game. We’ve had less cyber security
incidents in the last year than we’ve had in
previous years.”
During his rst 12 months, Cornelius’ main
task has been to secure Siemens Energy
internally and demonstrate this to custom-
ers. The rst real proof-point to customers of
that undertaking was achieved in May when
the company received Cyber Essentials
Plus (CE+) certication for Great Britain and
Ireland.
The government-backed certication, which
is a pre-requisite for national critical infrastruc-
ture projects, shows Siemens Energy provides
reliable products, solutions and services, and
also demonstrates the resilience of its policies
and procedures.
CE+ requires independent verication by
an external auditor who conducts a series of
technical assessments to ensure the company is
protected against various attack scenarios. The
evaluation, completed remotely in view of the
Covid-19 restrictions, assessed:
n Boundary rewalls
n Secure asset conguration
n Patch management
n User access controls
n Malware protection
n Mobile assets
The certication was awarded by ECSC, an
independent certifying body for the Cyber Es-
sentials programme, and must be re-certied
every 12 months. In total, around 5500 digital
assets were in the scope of the evaluation.
Steve Scrimshaw, Vice President, Siemens
Energy UK&I, commented: “Cyber-attacks
have become more sophisticated and com-
mon in today’s digital world. It is therefore
crucial for us as Siemens Energy to have
robust procedures and protections in place to
reduce cyber threats. Our customers want to
see that we provide reliable products, solu-
tions and services and also take the security
of their information seriously. Cyber security
is therefore mandatory for every reliable busi-
ness partner as well as being a prerequisite
for critical national infrastructure projects.”
Cornelius added: “We [the cyber team]
haven’t delivered CE+, Siemens Energy
employees have delivered it for themselves by
doing what’s been asked – following the guid-
ance and training, and doing what matters at
the right time. We are very proud of them.”
Receiving CE+ certication is, however,
only seen as the starting point and Siemens
Energy says it will continue to evolve and im-
prove its processes and procedures. Looking
forward, Siemens Energy has already identi-
ed some areas for further work. In addition to
re-certifying CE+ annually, it is continuing to
roll-out ISO 27001 compliance across its loca-
tions and businesses.
Over the next 12 months Cornelius says the
company will continue to identify, assess and
protect what he calls “critical assets”. This is
key data within the Siemens Energy business,
its suppliers, or that of customers. “This is a
continual cycle, we never just set and forget
– it’s discover, understand, protect and review
all the time.”
Cyber security: the experience of a UK CSO
Cornelius says Siemens Energy will
continue to evolve and improve its
processes
THE ENERGY INDUSTRY TIMES - JULY 2021
Special Technology Supplement
11
siemens-energy.com
The energy sector has become a primary
target for cyber attacks.
Siemens Energy helps its customers confront
the growing cyber threat with our protection,
detection, and monitoring solutions.
Perpetual
vigilance
for what’s mission critical
Siemens Energy is a registered trademark licensed by Siemens AG.
LET’S MAKE TOMORROW DIFFERENT TODAY.
