Hackathon on IT/OT cybersecurity Modern digital labs offer an optimal development environment

Related Vendors

Vinci Energies Deutschland GmbH

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

In an increasingly connected industry, security is becoming more important. With the NIS-2 directive since mid-October, cybersecurity is now mandatory. IT and OT must be considered together in this context. Digital labs offer a practical development environment for this purpose.

Whether denial-of-service, malware, or ransomware attacks—or a unique case like the Stuxnet computer worm—cyberattacks have become an everyday threat. The manufacturing industry, in particular, is increasingly becoming a target. According to a recent study by Cisco, Europe's industry is not well-prepared: more than 80 percent of industrial companies need to take action for better cybersecurity. Since, among other things, the control of plants and machines in industrial parks is often carried out by various process control systems, tailor-made cybersecurity solutions must be developed—there is no standard.

What such a development process looks like in practice was recently demonstrated by an OT hackathon at Vinci Energies' Digital Lab, the Digitalschmiede. Among the numerous use cases exhibited, there is also an application from the process industry that excellently showcases the challenges of IT/OT cybersecurity concepts. Three mixed teams from the Vinci Energies brands Actemium and Axians participated to develop an IT/OT cybersecurity concept for the process industry use case within three days.

Challenges of IT/OT security

With the upcoming implementation of the EU Directive NIS 2, the scope has been significantly expanded compared to its predecessor NIS 1: among other aspects, companies with at least 50 employees are included, and stricter security requirements and incident reporting obligations must be observed. Additionally, there is personal liability for the management and the board in case of non-compliance. This is a major challenge for the manufacturing industry, which must prepare for it.

In addition to legacy systems and the human factor, system landscapes such as various process control systems provide a large attack surface in industrial companies. This is especially true as IT and OT systems are increasingly interconnected—for example, through remote maintenance access and the widespread use of IP-based network protocols. The growing reliance on IT systems in the industry requires increased protection of cyber-physical systems, such as production facilities, automation technology, and operational technology. At the same time, many OT networks lack the necessary protection mechanisms to detect attacks or respond to them if the network is compromised.

The increased use of technologies such as machine learning and big data, along with differing requirements in IT and OT, contributes to the complexity of security requirements. For instance, IT is increasingly relying on cloud solutions, while in OT, portable storage media still hold significant importance.

Advantages of collaboration in business ecosystems

For the OT hackathon, a use case from the process industry set up in the Digitalschmiede was used. The basis of the system is a tank model equipped with various cameras and sensors for remote monitoring and control of process supervision. It visualizes process flows, controls plant components, and records data for analysis purposes. It also serves as a demonstrator for various process control systems from partners Siemens, B&R, and Schneider Electric, where the integration of the Module Type Package allows for easy communication among them.

The use case exemplifies how industrial plants are constructed and operated. Due to its complexity, it requires expertise from both IT (Axians) and OT (Actemium) and the constructive collaboration between the OT and IT worlds to develop comprehensive, efficient, and NIS-2-compliant cybersecurity concepts. The three OT hackathon teams received support from the aforementioned OT partners, cybersecurity solution provider Fortinet, and penetration testers from Soft Scheck, who provided valuable input. Such close collaboration between internal and external experts highlights the advantages of business ecosystems: open sharing to pool expertise closes gaps, creates a common understanding, and enables the development of innovative and tailor-made solutions even in very complex environments.

Seamless transition to customer challenges

After an intensive three-day exchange and careful planning, the three teams presented their different, integrative cybersecurity concepts to the jury, consisting of representatives of the partners. The teams developed a holistic concept that considered physical, technological, and organizational measures. In the joint discussion, the teams agreed to use protection level 3 according to the IEC 62443 standard as the benchmark for the security measures. A protection level 3 means that the showcase is to be protected against intentional misuse by sophisticated methods, specific expertise, and moderate motivation and resources. The insights and concepts gained here will now be further developed into a concrete overall solution and integrated into the tank model for demonstration purposes. The event thus served as a practical example: within the framework of the OT hackathon, it was vividly demonstrated to partners how the development of tailor-made concepts for IT/OT security can be successfully achieved in reality—and in the shortest possible time.

The two Vinci Energies brands Actemium and Axians have been working together for some time as industrial guardians in cross-functional teams, developing future-proof cybersecurity solutions for industrial customers so that they can fully comply with the NIS-2 directive. The hackathon has once again highlighted the importance of digital labs or innovation labs: when their work is oriented towards practical needs and comprehensive knowledge transfer takes place, they offer an ideal development environment to make a significant contribution to digitization strategies.