Looking through the

industrial cyber portal

Every power project has different requirements and components

that change the prerequisites for cyber security. At the same time,

cyber security needs to change over the lifetime of a project, making

it tricky to maintain a holistic overview of projects around the world.

Siemens Energy has therefore developed an industrial cyber

security portal that simplies the integration of cyber security into

each of its projects, with the aim of delivering products and solutions

guidelines.

To address these issues, the company

recently launched what it calls its In-

dustrial Cybersecurity Portal (ICS

Portal).

The portal is designed to simplify

security by providing specic func-

tion modules within a central reposi-

tory. Tasks and outcomes are stored

centrally so they can be evaluated and

any given project. Helping all our

Siemens Energy business units work-

ing with our portfolio, the ICS portal

provides transparency, for example,

on relevant security requirements for

their assets as well as guidance on

related vulnerabilities and their miti-

gation. Featuring automation capa-

bilities, and the ability to contextual-

ise, visualise, and structure the

nerability in an individual compo-

nent delivered to a customer, to a

solution from a sub-supplier that

does not meet the security require-

ments of the customer.

“To remain a trusted partner for our

customers, our portfolio must become

secure by design to protect adequately

against cyber threats, meeting global

regulatory requirements and stan-

hile digitalisation is seen as

a key pillar of the energy

devices connected to the industrial

internet poses a real threat. Certainly,

it is a major concern for executives.

According to PwC’s 25th Annual

Global CEO Survey, 44 per cent of

energy, utilities and resources CEOs

ranked cyber threats as a “top three”

concern. And of all sectors, energy is

the manufacturing industry, the nan-

cial sector, and the professional ser-

vices sector. The war in Ukraine has

no doubt heightened that threat. In

April, for instance, Ukraine’s Com-

puter Emergency Response Team

announced that it had successfully

repelled a series of cyber attacks on

the country’s power grid.

In the past, hacking energy infra-

technology (IT) and operational

technology (OT) converge, this is no

longer the case.

Today, utilities, factories, etc., typi-

cally use IT systems connected to OT

equipment. This makes it easier than

ever for cyber criminals – whether

nations (cyber warfare) or individuals

– to not only inltrate the IT of a

company, but also the attached OT

operated via those IT systems. To

keep the critical infrastructure secure,

providers of energy technology

do as a company, Bernhard Mehlig,

Industrial Cybersecurity Consultant,

Siemens Energy, said: “Companies

that provide us with electricity, natu-

ral gas for heating or oil for transport,

operate complex manufacturing and

production sites that use digital solu-

tions to make their operations more

efcient and protable. These are at

risk from various types of hackers.

provide.”

Rune Stensletten, Head of Industrial

Cybersecurity Ofce (ICS Ofce),

Siemens Energy, added: “The indus-

trial products and solutions we pro-

vide to our customers cannot be pro-

tected in the same way as IT

infrastructure. Trying to secure these

systems is a highly complex task. So

what we are doing is trying to collect

and product development.”

Although each business unit of Sie-

mens Energy has its own industrial

cyber security community, which

oversees cyber security for products

and solutions coming out of the spe-

cic business unit, the central ICS

Ofce coordinates all the various ef-

forts. This includes cyber resilience

of Siemens Energy’s various manu-

projects, answering all questions and

meeting the needs of the customer.

But in an environment that is changing

ects to ensure that the activities that

have been dened are actually being

followed – kind of like a quality

[control] function. There is also an

ICS expert, who will help with the

technical implementation and veri-

cation of requirements, etc.

“The idea is that the tool will guide

you through all the cyber security

activities, allow you to customise ac-

performance indicators (KPIs), gen-

erate queries and create reports on, for

example, projects that have reached a

certain stage.

Mehlig explained: “This is impor-

tant for us centrally and for the port-

folio. We can, for example, look at all

projects in a certain area and see how

many components have been sold

there, what their current status or risk

ganisation is lagging. For example,

we can nd out where, say, vulnerabil-

ity mitigation is taking very long. The

portal will allow the organisation to

monitor itself in order to learn and

improve.”

In addition to further developing

the tool, the ICS team’s next steps

will be to reap the rewards of its

work by raising awareness of the

process that ensures implementation

of cyber security before the solution

is handed over.

Stensletten summed up: “We have

been a small group, currently working

on the development of the portal’s

functionality and verifying that the

technology is working. Now we will

introduce it to the whole company by

implementing the module for the ini-

processes. The ICS portal is a tool that

covers the whole lifecycle of cyber

security for our customers’ projects,”

said Mehlig.

The portal will have a number of

modules to support both Siemens

Energy and its customers. With the

rst release of the ICS Portal it is al-

ready possible to:

In the next iteration, the ICS team

plans to introduce other functions like

risk assessment to give an indication

of the type of cyber security that

should be planned for project execu-

tion; vulnerability management in

assets and components; secure sup-

plier cyber security evaluation; and

project security activities guidance.