What about OT security in the water sector?

Managing Director of the Competence Center for Digital Water Management (KdW), Ronald Derler, outlines the specific challenges of OT cybersecurity in water utilities. As Director of the Cybersec@Wasser situation center, he talks about the institution's origins and approach, best practices for the industry, and the importance of CRA and NIS2.

Duration:

22 min

Guest in this episode:

Ronald Derler

CEO Competence Center for Digital Water Management

FAQ

Facts on the topic

How does OT security in the water sector differ from other industries?

In the water sector, the priority is not high-speed real-time processing (like in automotive manufacturing), but rather the protection of life and the environment. A failure or manipulation of water quality has immediate consequences for public health. The core challenge is that many utilities—especially small and medium-sized ones—lack dedicated in-house security experts, while their infrastructure is becoming increasingly networked and vulnerable.

What are the most common attack vectors for water utilities?

Experience from the Competence Center for Digital Water Management (KdW) shows that attackers rarely use the "front door." The most critical entry points are:

Service Providers & Supply Chain: External partners often have broad remote access permissions.
Remote Access: Insecure VPNs or open maintenance ports are primary targets.
Social Engineering: Targeted deception of employees to gain network credentials.

What is the role of the KdW as a "Sector SOC"?

Since cybersecurity experts "don't grow on trees," the KdW (Cybersec@Wasser) functions as a centralized Sector SOC. It pools specialized knowledge and analyzes incident data from various water utilities centrally. This collaborative approach allows even the smallest utilities to benefit from professional intrusion detection without having to build a complex security department themselves. The KdW is technology-agnostic and assists in rapid incident response.

‍

How does the NIS2 Directive change obligations for water utilities?

Previously, only a small fraction of the water industry was regulated as critical infrastructure (KRITIS). With NIS2, the thresholds have been significantly lowered. Many companies that could previously ignore cybersecurity are now facing new legal obligations. These include implementing Intrusion Detection Systems (IDS), stricter incident reporting requirements, and direct liability for management.

What are the best practices for Intrusion Detection (IDS) in the water sector?

Key guidance can be found in the BSI’s (Federal Office for Information Security) recommendations on the "use of intrusion detection systems." Best practices include:

stablishing Visibility: Continuously monitor operations to detect anomalies immediately.
Rapid Response Capability: It is not enough to just detect; you must establish processes that enable quick recovery in an emergency.
Collaboration: Utilizing sector-specific solutions like the KdW to learn from the data and insights of the entire industry.