Support service ISMS – Attack detection systems
astora GmbH (astora), headquartered in Kassel, is one of the largest natural gas storage operators in Europe. astora markets a total natural gas storage volume of almost 6 billion cubic meters. The company thus holds around 25 percent of Germany's total natural gas storage capacity.
The natural gas storage facilities in Rehden and Jemgum represent critical infrastructures as defined by the BSI-Act and the BSI Ordinance Determining Critical Infrastructures (KritisV). Operators of such energy supply networks and facilities, which are considered Critical Infrastructure according to the legal ordinance pursuant to Section 10 (1) BSIG, must prove the use of an attack detection system (ADS) to the Federal Office for Information Security for the first time on May 1, 2023 (and every 2 years thereafter) pursuant to Section 11 (1f) EnWG.
In order to prepare astora in the best possible way for this audit, secunet provided support for the ADS concept. The BSI guidance on the use of attack detection systems served as the basis for requirements in this context.
In joint workshops, the current status with regard to requirements fulfillment was first determined. The basis for this was an audit tool created by secunet, which also graphically shows existing deficiencies and enables structured processing of still open requirements. Based on these results, the strategy was then developed and a project plan drawn up. Already in an early phase, secunet was involved in the creation of necessary documentation. In the further course of the project, secunet supported astora GmbH in organizational as well as technical aspects, such as the definition of rules and regulations for the Security Information and Event Management (SIEM) and the testing and documentation of the integrated log data sources.
In the context of regular jour fixes and workshops, whose participants varied depending on the topic, a continuous exchange was ensured. When drawing up catalogs of measures, both astora's internal requirements and requirements from the guidance were taken into account. The result was a custom-fit, individual attack detection system that reflected the legal requirements. In order to prepare astora for the audit in the best possible way, the audit tool, which mapped the requirements from the orientation guide, was completed and evaluated together. Subsequently, secunet accompanied the audit by an external auditing body.
Even after the successful proof, secunet will continue to support the following project tasks in order to ensure continuous improvement of the attack detection system.
