Attack detection systems in municipal utilities, water works, and network operators

In the public perception, attack detection systems are often reduced to what their name implies. However, energy and utility companies can solve several challenges simultaneously with an attack detection system, especially when it monitors control system and telecontrol technology. In addition to obvious cybersecurity benefits, these solutions address compliance, supply chain security, business continuity, and system availability.

Compliance

Regulatory compliance remains the primary driver for many critical infrastructure (CRITIS) operators to implement an Attack Detection System (ADS) within their infrastructure. A recurring challenge is defining what exactly an ADS is and what it encompasses. For some, it refers to firewalls at network perimeters; for regulatory authorities like the BSI, it represents a comprehensive management system.

However, a relatively clear definition of its functions and scope has existed for years under IT-SIG 2.0 (IT Security Act 2.0). According to the framework, an ADS must:

1. Monitor the critical processes and assets of utility providers. This implies that, at a minimum, industrial energy supply processes and assets must be covered. Traditional IT solutions and firewalls carry little weight here because they reside at the perimeter or outside critical assets and rarely understand operational technology (OT) protocols. Conversely, an ADS deployed directly within industrial infrastructure (OT) monitors the exact scope required by law.
2. Continuously collect data to detect attacks. Opinions diverge on this point: Is collecting data exclusively at the network perimeter sufficient? Or, in today’s threat landscape, where initial access is increasingly gained via stolen credentials, should internal networks also be scrutinized? (See Point 1).
3. Defend against attacks. This, in turn, requires that attacks can be detected, localized, and traced in the first place, bringing us back to Point 2.

For municipal utilities, water suppliers, and network operators, compliance involves more than just proving the presence of an ADS; it critically includes fulfilling mandatory incident reporting obligations. An OT attack detection system—such as Rhebo Industrial Protector—detects and documents all cyber incidents in detail, comprehensively, and over time. Suspicious OT activities are captured and saved as Packet Capture files (PCAP), allowing incidents to be analyzed and reported in accordance with statutory requirements.

Asset management

Asset documentation remains incomplete across many industrial infrastructures. This creates a hurdle not only for cybersecurity, but also for overall asset management and grid operations. Which devices and systems are actually running in the OT environment? What dependencies exist? Which assets are critical for grid operations?

An OT attack detection system generates a network map (see image) of all communicating assets, including their properties, connections, and throughput. This provides asset managers with clarity regarding the inventory of OT devices and systems, as well as their structural relationships—simplifying the planning of repairs, retrofits, and routine maintenance.

‍

‍

Risk management

Risk management is no longer merely a compliance exercise, it has become an integral management responsibility essential for securing long-term service delivery. Utilizing actionable insights, and specifically the network map provided by the OT ADS, risk management teams can better evaluate:

• System dependencies and interactions.
• Vulnerabilities present within the OT network.
• Exposed critical systems (e.g., through connected secondary systems subject to vulnerability advisories or that are exposed themselves).
• Security gaps in OT communications, such as insecure protocols, missing authentication, and related issues.

Cybersecurity against the unknown

Cybersecurity is not one-size-fits-all. Established IT security approaches still heavily rely on known malware signatures (blocklisting). However, the threat landscape has evolved significantly. The integration of AI into cyberattacks further reduces the effectiveness of signature-based detection and strict allowlisting. Beyond traditional methods, modern defense strategies must focus on detecting early deviations in legitimate communications. These anomalies are particularly easy to isolate in OT, as industrial communications are typically highly deterministic and repetitive.

In addition to traditional malware detection, an ADS equipped with anomaly detection enables organizations to:

• Identify the exploitation of zero-day vulnerabilities.
• Detect multi-stage cyberattacks (e.g., lateral movement, network scans, unauthorized manipulations).
• Detect OT communication tampering using Deep Packet Inspection (DPI).
• Uncover attacks originating from legitimate user accounts (including administrative accounts).
• Detect attacks utilizing "Living-off-the-Land" (LotL) techniques.
• Indirectly secure legacy systems that no longer receive security updates. Assets that cannot be patched directly are not a lost cause; they simply require closer monitoring to detect potential compromises via anomalous system behavior in real time.

System Availability

In industrial environments such as substations, high- and medium-voltage grids, and water treatment or wastewater facilities, system availability is paramount. Cyberattacks currently represent the less frequent threat; technical glitches, network degradation, switch failures, or checksum errors are everyday operational challenges.

Consequently, an ADS with anomaly detection should reliably identify and report technical error states alongside cybersecurity events. Deviating round-trip times (latency) or communication drops can be flagged early, enabling maintenance teams to locate and repair/replace faulty devices or correct misconfigurations as part of preventive maintenance.

Business Continuity and Cyber Resilience

After an attack comes recovery, and preparation for the next attempt. To execute a secure, sustainable recovery while building resilience against future incidents, organizations require clear visibility into:

• Which systems were impacted.
• How the attack unfolded.
• Which Tactics, techniques, and procedures (TTPs) the threat actors employed.

A high-performance ADS captures and stores every OT communication anomaly as a PCAP file. By documenting anomalies in detail, investigation teams can use forensic analysis to reconstruct exact incident timelines and establish what occurred during the attack.

Supply chain security

Supply chain security is a double-edged sword. While crucial for compliance and risk management, enforcing and auditing cybersecurity practices within third-party vendor operations is often unrealistic. Few suppliers allow customers to dictate internal cybersecurity standards.

Essentially, the supply chain must be treated like a legacy system: what cannot be directly controlled must be rigorously monitored. An ADS with anomaly detection helps to:

• Detect altered behavior in OT components.
• Identify known vulnerabilities in deployed systems and components.
• Detect failed login attempts (e.g., via VPN or remote access) on service ports.

This enables early detection of compromised third-party technology and infrastructure, providing concrete evidence to pressure vendors toward implementing stronger cybersecurity measures in their product development and service delivery.

Conclusion

For municipal utilities, network operators, and water suppliers, an OT attack detection system  is far more than a tool to ensure NIS2 compliance. It actively supports operators in boosting system availability while mastering operational challenges across asset management and supply chain security.