Control system cybersecurity services

Omnivise cyber inspection is an end point detect and response (EDR) service that fulfills the preventive part of REC cybersecurity service. Its capabilities are extended to the point where it can operate as a true remote forensics tool.

To support compliance with regulations, cyber inspection offers cyberssecurity status (profile) and event report, meeting ISO 27001 standards. This gives customers access to a detailed inventory of their systems configurations and settings. Daily data analysis is used to create alarms on abnormal situations. These alarms are extracted and presented including recommendation via the Siemens Energy Portal. More important, red alarms are daily managed by the REC cSOC cyber hotline team.

Whenever a cyber hotline ticket is raised by a red cyber inspection alarm or a reported issue from the customer is identified as a cyber issue, REC’s cSOC team reactively takes action. Before solving and/ or support rectifying possible problems, the first level of support is Triage – which is a comprehensive standard algorithm. Triage aims to identify and separate events from cyber events that need to be handled in greater depth and will be handed over to the specific incident response service.

If a real incident is identified in Triage, the incident response team is activated. Here a full forensic analysis of the system will be performed, and all levels of support are provided to the customer up to the point where a report submission is made to the appropriate authorities, if applicable. The incident response service will carry out a forensic investigation to identify the nature and origin of the threat in question, to clarify potential points of weakness, and confirm elimination of the threat, together with recommendations and lessons learned.