Germany’s Federal Office for Information Security (BSI) has published cybersecurity recommendations to protect industrial control systems accessible via the internet. The agency strongly recommends securing networked control systems. The guidance targets operators of small and very small facilities, including hydropower plants, wind farms, waste-to-energy facilities and PV installations of all sizes.

The main recommendation is to eliminate direct internet access to plant control systems. In PV installations, these systems may include industrial controllers, communications equipment, monitoring gateways, inverters, supervisory control and data acquisition (SCADA) systems and remote monitoring platforms.

Connecting these systems directly to the internet increases their exposure to cyberattacks. Systems accessible via public networks may be vulnerable to unauthorized access attempts, exploitation of known security flaws or manipulation of operating parameters. The risks extend beyond the loss of monitoring data, as incidents affecting operational technology (OT) systems can disrupt plant control and operations.

The BSI recommends replacing direct internet access with secure remote connections using virtual private networks (VPNs) and multifactor authentication. VPNs establish encrypted connections between authorized users and plant networks, while multifactor authentication requires an additional form of identity verification beyond a password. Although these measures do not eliminate cybersecurity risks, they reduce the likelihood of unauthorized access resulting from stolen credentials or weak passwords.

The agency also recommends keeping equipment up to date and promptly installing security patches and software updates. This applies to supervisory systems and connected field devices, including routers, firewalls, controllers, inverters and communications gateways. Failure to install updates can leave systems vulnerable to known security flaws for which fixes are already available.

Source link