CRITIS 2018 KEYNOTES
Dr. Stefan Lüders
Head of Computer Security at CERN, Switzerland
Bridging the gap between ICS and corporate IT security: Finding common culture and views
25 September, 2018 (Plenary Session)
The Large Hadron Collider (LHC) at the European Organization for Nuclear Research (CERN) is a unique one-off prototype within the particle physics community. The accelerator itself and its attached experiments are development, managed and operated from a world-wide community of physicists, engineers and technicians. In parallel, CERN serves as a university-like campus for this community and provides the IT environment for massive data storage, computing clusters and any other service needed to enable collaboration and research. As such, "one-off prototype" and "world-wide community" plus the general attitude of an academic environment present particular challenges in securing CERN’s data centres, the office networks and the multitude of different control systems deployed for running the LHC and its experiments.
Stefan Lüders, PhD, graduated from the Swiss Federal Institute of Technology in Zurich and joined CERN in 2002. Since 2009, he is heading the CERN Computer Security Incident Response Team as CERN’s Computer Security Officer with the mandate to coordinate all aspects of CERN’s computer security – office computing security, computer centre security, GRID computing security and control system security – whilst taking into account CERN’s operational needs. Dr. Lüders has presented on computer security and control system cyber-security topics at many different occasions to international bodies, governments, and companies, and published several articles.
Dr. Hayretdin Bahşi
Center for Digital Forensics and Cyber Security, Tallinn University of Technology, Estonia
Comparison of Nordic and Continental Europe Grids from the Cyber Resilience Perspective
26 September, 2018 (Plenary Session)
Baltic States have investigated the options of de-synchronisation from Russia controlled IPS/UPS system and synchronisation with Continental Europe or Nordic Grids. In this presentation, the comparison between the cyber resilience levels of Nordic and Continental Europe grids is given in order to provide domain-specific insight into this strategic decision. Moreover, additional technical and organizational countermeasures that can be taken during this transition period are provided as guidance for transmission system operators and relevant national/international authorities. The comparison is conducted at five levels, transmission system operator, energy sector, critical infrastructure, national and grid levels.
This comparison was conducted as a part of the comprehensive analysis coordinated by International Centre for Defence and Security. In addition to the cyber resiliency aspect, political, geopolitical and physical security aspects were incorporated into the analysis which was published in a report named as “The Geopolitics of Power Grids: Political and Security Aspects of Baltic Synchronization”).
Dr Hayretdin Bahşi received his PhD from Sabancı University (Turkey) in 2010. He was involved in many R&D and consultancy projects on cyber security as a researcher, consultant, trainer, project manager and program coordinator at the Informatics and Information Security Research Centre of the Scientific and Technological Research Council of Turkey between 2000 and 2014. He acted as the founding director of National Cyber Security Research Institute. Currently, he is a senior researcher at the Centre for Digital Forensics and Cyber Security at Tallinn University of Technology. His research interests include critical information infrastructure security, cyber situational awareness systems and application of machine learning methods to cyber security problems.
CRITIS 2018 Invited sessions
ENERGY INFRASTRUCTURE OPERATORS AND STAKEHOLDERS: KEY CHALLENGES AND SOLUTION DIRECTIONS
(25 September, 2018)
Head of Unit "Energy Security, Distribution and Markets",
Directorate C "Energy, Transport and Climate",
EC Joint Research Centre in Petten, the Netherlands.
Enel Security representative and EE-ISAC Chair, Enel, Italy
Building a network of trust among European utilities to foster proactive security though info sharing
25 September, 2018: 14.45 – 15.15
The private operators have a reduced self-sufficiency when facing threats aimed to compromise the critical infrastructures due, for example, to limited resources, legal implications and variable capability to influence provider’s roadmap to obtain secure by design solutions. To overcoming these gaps, operators must act proactively: cooperate with each other, with institutions and authorities in terms of info sharing, simulations, joint programs and trainings. EE-ISAC is a no profit association founded by Enel and other European utilities with the aim to build a trusted community, where the members can discuss on threats and vulnerabilities that are affecting their infrastructures and cooperate in building awareness and security culture dissemination. EE-ISAC is the outcome of Distributed Energy Security Knowledge (DENSEK), a CIPS European project launched in 2012. The presentation will illustrate the achievements of the association and its perspective fostering critical infrastructure resilience.
Massimo Rocca is a cyber security expert and the Head of Enel’s Security Processes, systems and planning unit. Based in Italy, he participates to several national and international working groups on critical infrastructure protection and coordinates the multinational’s security activities in more than 40 Countries. Leveraging on this visibility, he sponsored the development of a cooperation network to assist other security managers from the utilities; in few years, it became the first European Energy - Information Sharing and Analysis Center.
Head, Cyber Security (CSO/CISO), BKW Group, Switzerland
Securing BKW's Electrical Power Production and Distribution: A 3D Approach to Cyber Threats
25 September, 2018: 15.15 – 15.45
The BKW Group is a Bern-based international energy and infrastructure company with more than 6,500 employees. The Group plans, builds and operates infrastructure to produce and supply energy to businesses, households and the public sector. In addition, it offers engineering of energy, infrastructure and environmental projects, building technology planning, installation and maintenance as well as the construction, servicing and maintenance of energy, telecommunications, transport and water networks. To protect its IT and OT infrastructures, BKW runs a three year program addressing Cyber Security with a three dimensional approach: Creating Awareness and Acceptance, fully implementing IT, OT and PHY Protection and improving Resilience and Reaction.
After his studies in Civil Engineering at ETH Zurich Ivo Maritz was an Assistant in Computer Science and then the Deputy Manager of the newly founded Informatics Services at the University of Berne. After a station with one of the large Swiss Banks, he held different ICT leadership positions with a global Pharmaceutical Corporation headquartered in Basel during 11 years. Thereafter he ran Engineering and Operations as the CTO and COO of a Swiss Telecom Carrier providing B2B and B2B2C services. Before joining BKW in 2014, Ivo led the ICT Infrastructure Organization of a globally operating Machinery Industry group. With the BKW Group Ivo served as its CIO, leading the ICT Business Unit with 160 employees. He initialized the next steps of the digital trans-formation of the company on the IT side. Since the beginning of 2017, Ivo leads primarily the Cyber Security Program of the BKW Group as its CSO/CISO.
BKW is a Berne-based international energy and infrastructure services corporation with more than 6,500 employees.
Security of Supply Unit, European Commission’s Directorate General for Energy
Cybersecurity in the energy sector – The EU perspective
25 September, 2018: 16.45 – 17.15
The energy system is one of the most complex and largest infrastructures in Europe as well as one of the most critical assets for a modern society. Due to the needs to tackle climate change, the energy sector of today is undergoing a very rapid change in terms of infrastructure and market. In particular, it is subject to a continuously increasing degree of digitalization, bringing new challenges for the sector with respect to cybersecurity.
Thus, it is indispensable to take into account the particularities of the energy sector that create challenges in terms of cybersecurity: (1) real-time requirements, (2) cascading effect, and (3) the combination of legacy systems with emerging technologies.
Ms Michaela Kollau works at the European Commission’s Directorate General for Energy dealing with cybersecurity in the energy sector and security of supply. She joined the European Commission in 2014 following a career in the Austrian Regulatory Authority for the electricity and gas market. Ms Kollau studied in Austria (Graz), the US (New Mexico) and in France (Nice - Sophia Antipolis) and holds master degrees in economics and environmental system sciences.
Regional Manager for Europe, World Energy Council, Estonia
Implications of political and policy decisions to energy security
25 September, 2018: 17.15 – 17.45
Energy sector is going through a number of parallel transitions in terms of technologies, market designs, business models and resilience. An energy policy has to guarantee in parallel with energy security also sustainability and affordability of energy supplies. The presentation will focus on several examples from Europe, where political or policy framework has supported or hindered those transitions, especially in terms of energy security. It also takes a look into coming future by analysing what trends and developments are likely to influence the power sector of Europe in the coming decade in terms of energy security.
Dr. Einari Kisel is the Regional Manager for Europe in the World Energy Council Secretariat. He is responsible for the development of relations with all European Member Committees, companies and institutions. In 2017 he was also nominated to act as a Member of Supervisory Board of Eesti Energia AS, Estonian energy utility. Before joining WEC Secretariat in 2012, he was engaged for 10 years as the Undersecretary of State for Energy (until 2008 as the Director of Energy Department) in the Ministry of Economic Affairs and Communications of Estonia, being responsible for all energy policy affairs of the state. Until 2002 he worked for 7 years in the Estonian energy utility Eesti Energia, where his last duty was the appointment as the Director of Trade. He has received PhD degree in Power Engineering, and Master degrees in Thermal Engineering and in Business Administration from Tallinn University of Technology.
Head of Strategic Analysis Division, NATO Energy Security Centre of Excellence, Republic of Lithuania
Role of Public - Private Partnership in Critical Energy Infrastructure Protection: NATO ENSEC COE Perspective
25 September, 2018: 17.45 – 18.15
While most of critical energy infrastructures are owned by the private sector, the government has the responsibility to regulate it as well as protect it to some extent especially where protection is too important to leave to the private sector. In order to protect critical energy infrastructure, the risk management programme should incorporate the main stakeholders, share of responsibilities, analysis of the possible threats, the risk assessment, the vulnerabilities, and the implementation of hazard mitigation procedures. In this context, the risk analysis is particularly important because it is useful to determine the likelihood that an event occurs.
Public-Private Partnerships (PPPs), which are long-term contracts between a public agency or public sector authority and a private sector entity, are a key factor in the protection of critical energy infrastructure. They are crucial in terms of efficient response to the worldwide escalating threats that may jeopardize the good functioning of critical energy infrastructures. In spite of this, the establishment of PPPs is not an easy process for a number of reasons. One reason concerns the fact that the interests of the state and of companies do not coincide. Indeed, while the main interest of the state is national security, companies are very much business-oriented. This means that these latter accept to make critical energy infrastructure secure only to the point that it is profitable, which means to the extent that the cost of dealing with an outage would cost more than preventing it. Another reason concerns the problem of information sharing. The private and the public sectors are not always willing to share all the necessary information and techniques related to risk assessment, the identification of weak spots, plans and technology to prevent attacks and disruptions, and plans for recovering from them.
The commitment of international organisations such as NATO and the OSCE in protecting critical energy infrastructure is of utmost importance because they concretely contribute to information and knowledge sharing among their members. Those afore mentioned and other related issues will be discussed in the presentation.
Artūras Petkus received his PhD in Laws from Mykolas Romeris University (Lithuania) in 2006. After 15 years of experience working as lecturer and later as associate professor at university, he joined the Strategic Analysis Division of the NATO Energy Security Centre of Excellence in 2015 as a Head of division. His main areas of responsibility are: performance of energy security related analysis on strategic level; contribution to petroleum supply chain analysis; assessment of energy security risks and threats, as well as Critical Energy Infrastructure Protection; contribution to development of NATO ACT Strategic Foresight Analysis Report as well as Framework for Future Alliance Operations Report; contribution to research in field of Energy Security (Overview of energy security in Baltic States, study “Hybrid Conflict and Critical Energy Infrastructure: the Case of Ukraine” etc.); analysis of physical threats to the power transmission system of Baltic States.