They are very real, and in recent years they have increased significantly. For one thing, we keep seeing media reports about major cyber-attacks. Other indicators include the very concrete and non-public warnings sent out by security agencies to operating companies – that sort of thing doesn’t happen without good reason.

A conceivable cyber-attack could take the form where an attacker attempts to manipulate the supply control system in order to trigger unauthorized switching operations. If such an attack were to be successful, the worst case scenario would be a complete failure of the power supply. In the future, the technology installed at end consumers and their personal data could be at risk of attack since intelligent electricity meters and electric cars increasingly go hand in hand with new interfaces. This is where we might expect to encounter a more “old-school” hacker working alone.
At present, the biggest threat is posed by either directly or indirectly state-sponsored players. They have the resources for more complex attacks. Blackmail by organized cyber criminals would also be conceivable. But I don’t think that terrorist attacks on our power grids are very likely.

All the steps associated with digitalization and widescale networking demand appropriate security measures. After all, nobody would think of launching a car on the market that didn’t have any brakes. For operating companies, this means treating the hardware and software together, and for example introducing controlled access protection and network zoning, i.e. dividing the network up into areas that are separated by secure interfaces. For their part, it is absolutely vital that operating companies build up a security organization that employs diligent update management strategies, while component manufacturers in turn must ensure secure and robust implementation. Last but not least, comprehensive employee training is very important. But precautions alone are not enough. Emergency response plans must be in place for security issues such as cyber-attacks or infrastructure disruptions that are able to take effect quickly to restore normal operation.

Of course, costs are also an issue in the world of information security. And for operating companies running critical infrastructures, legal requirements mean that these costs are generally higher than for smaller public utility companies. When it comes to cost effectiveness, security measures and application scenarios need to be considered together in all cases. For example, does the added comfort and efficiency of app-based access to station control technology via smartphone merit the comprehensive security measures that are required as a result? This is something we have to decide on a case-by-case basis.

Whereas information security used to be a specialized problem, today it penetrates into all areas of our technologically sophisticated society, and particularly also into energy supply systems. Manufacturers and operating companies need to – and will – develop standardized solution concepts. Since both the application scenarios in IT technology and control technology and the methods of the attackers will keep evolving, we will never be able to stop talking about cyber security.