The ‘Handprint’ of good work
How our M&P Energy Team achieves measurable positive impact in projects.
Critical infrastructure:
Is your building secure against attacks?
The new M&P demonstrator showcases effective security solutions for your building automation.
Everything under control? Stay vigilant. Cyberattacks often start where you least expect them: in the building services systems. M&P shows how building automation networks can be set up securely and resiliently.
When connectivity becomes a vulnerability
The increasing interconnection of IT systems (servers, networks, clouds) and OT components such as ventilation, lighting or lift systems creates efficiency – but also opens up new entry points for hybrid cyberattacks. And this applies not only digitally, but also physically through the manipulation of hardware or access systems. Attackers have long since ceased to target only core processes such as production. Instead, they specifically exploit vulnerabilities in supporting systems: building automation, energy supply or air conditioning.
“Although companies are aware of the risks, the danger is still underestimated,” says Bastian, OT Security Team Leader in the GA division at M&P Braunschweig. “The security of critical infrastructure also depends on smoothly functioning building services. What use are access control systems in a cleanroom laboratory if ventilation systems fail due to sabotage?” The consequences are disastrous: cyberattacks that bring entire value chains to a standstill – resulting in prolonged operational disruptions, significant financial losses and damage to reputation.
Implementing OT security now – M&P shows how
IT managers are often faced with seemingly intractable challenges: many OT systems were developed without modern security standards. Outdated components are difficult to patch; they must be replaced and brought up to new standards. At the same time, it often remains unclear who is responsible – IT or facility management?
Added to this are regulatory requirements such as NIS-2, CRA, ISO 27001, BSI IT-Grundschutz or IEC 62443. These require technical and organisational measures: from risk analysis to continuous audits. How can these requirements be integrated into heterogeneous OT landscapes without jeopardising the availability of critical (business) processes?
M&P provides a practical solution. Our proprietary Proof of Concept (PoC) demonstrates how GA networks can be set up securely, resiliently and independently of specific manufacturers – tailored precisely to individual requirements.
The M&P PoC demonstrator: hands-on security
“It fits, figuratively speaking, in the boot of a car and can be set up directly at the customer’s premises. The test rig replicates a complete building automation system – deliberately complex to demonstrate that we can meet any requirement.”
The application examples range from BSI IT-Grundschutz and protection zone concepts, through network segmentation, virtualisation and server infrastructure, to firewalling, monitoring and defence concepts in accordance with NuK and BCM. The demonstrator uses off-the-shelf components, is individually configurable and can be tested without risk.
“Companies are reluctant to test security parameters on their live systems – the risk of production downtime would be too great. With our PoC, scenarios can be tested safely – and many realise that OT security is achievable,” says Bastian.
The M&P demonstrator is continuously being further developed in customer projects. This also generates internal organisational knowledge that enables the entire M&P Group to provide comprehensive and forward-looking support to customers – as a pioneer in OT security.Because one thing is certain: cyberattacks do not happen ‘sometime’.
They happen precisely when you are unprepared. With M&P, you can turn your buildings into your first line of defence.
