La Voz de la Industria The Voice of the Industry

The Industrial Cybersecurity Center (CCI) presented the document “European Industrial Cybersecurity Regulatory Landscape”, which contains a non-exhaustive list of the current European legislation applying to the industrial ecosystem, which relates or can be related to cybersecurity in this area. A number of regulatory frameworks have been explored in the following countries: Belgium (BE), Germany (DE), Spain (ES), France (FR), Italy (IT), Netherlands (NL), Portugal (PO) ), Romania (RO), Turkey (TR) and the United Kingdom (United Kingdom). With special mention to the implications of the transposition of the European NIS directive for critical infrastructure operators and essential services.

  José Valiente, director of the CCI, started the day by announcing that the Center has three teams of expertise, “Industrial Critical Infrastructures”, “Smart OT” and “EPC”, which will be joined by a new team called “Compliance”. will focus on the implications of compliance in industrial cybersecurity.

  Miguel García-Menéndez then presented the document “European Industrial Cybersecurity Regulatory Landscape”, and some standards or regulatory frameworks that have appeared in Europe in recent years and are linked to cybersecurity. referred to the popularly known as NIS Directive, “whose main objective is to achieve a high and homogeneous level of security in the networks and information systems of the European Union.” Likewise, García-Menéndez referred to the new European Data Protection Regulation , whose transposition to the Spanish scope must materialize before August 25, 2018. Finally, he referred to the ICCF, which aims to become an articulated frame of reference that specifies the principles, activities and actors of an evaluation of components of an industrial automation solution. ICCF have been involved the ICC, industrial manufacturers, such as SIEMENS, certifiers, and the National Institute of Cybersecurity (Incibe) of Spain.

  Sergio J. Fernández, operations analyst at CNPIC, presented the CERT of Safety and Industry (CERTSI_), which, by agreement of the National Cybersecurity Council of May 29, 2015, is the National CERT competent in prevention, mitigation and response to cyber incidents in business, citizens and critical infrastructure operators. Fernández, presented some of the most outstanding services of CERTSI, such as the ICARO service for preventive detection, or cyber-exercises. He ended his presentation by commenting on the situation of the working group on transposition of the NIS directive, made up of MINETAD, CCN, DSN and MIR.

  A representative of the CNPIC then presented the CCN-CERT, competent Government / National CERT, as well as some of its main services for the detection, analysis, auditing and exchange of sensitive information, especially highlighting the early warning service, highlighting sat-inet, internet probes and the recent sat-ICS, specific for industrial control systems, within which are inspected protocols and anomalies in industrial processes.

  Nuria Andrés and Santiago Pérez, representing Dimension Data, presented IoT and Cloud as enablers of the Digital and Secure Industry, showing their technological experience in the Tour de France, and some of the main risks in IoT, such as lack of perimeter or standardization , but also recommendations such as good practice in code development or security testing.

  Then came the makers of cybersecurity technologies. Bosco Espinosa began, representing Kaspersky, which showed the need for awareness and mutual association of engineers, business management and IT security. It ended with the presentation of “Kaspersky Industrial Cybersecurity” based on solutions and services to predict, detect, protect and respond. Highlighting agreements with industrial manufacturers such as Siemens, ABB or Schneider of their solutions.

  Then David Galdrán, Check Point’s Security Engineer who talked about the era of digital transformation highlighting the role of connectivity to the cloud from mobile devices. It showed the vectors of attack in an OT network and the best practices for its protection, highlighting the segmentation, protection against APTs and the use of specialized technologies.