In Germany, the IT Security Act was comprehensively expanded in summer 2015 with a view to such cases. Among other things, it now stipulates that operators of critical infrastructure (KRITIS) must provide the BSI with proof of compliance with state-of-the-art IT security every two years.

Water sector as a pioneer in IT security

In order to derive concrete and appropriate measures for the respective industry from this general requirement of the legislator, the KRITIS operators and their associations develop industry-specific security standards, the suitability of which must be determined by the BSI before publication.

BSI President Arne Schönbohm: "The sector-specific security standard for water/wastewater is the basis for more cyber security in this vital supply sector for the state, economy and society."

© Federal Office for Information Security

The review of a developed security standard by a federal authority is a first for the regulatory associations, said Otto Schaaf, President of the German Association for Water, Wastewater and Waste (DWA), during the publication of the KRITIS security standard for the water sector. It is the first and so far only sector-specific KRITIS security standard in Germany whose suitability has been determined by the BSI. It contains framework requirements for IT security that take into account the actual conditions in drinking water supply and wastewater disposal, a concrete procedure for risk analysis and a collection of possible security measures to reduce the identified risks.

According to the BSI, two industry standards for information and communication technology (data center & hosting and internet infrastructure), one standard for the food industry and one for the finance and insurance sector are currently being reviewed or created.

Cyber attack also penetrates Chernobyl exclusion zone

According to a Bitkom study, every second company has been the victim of a cyber attack in the last two years. The recent attacks by WannaCry and NotPetya made it clear just how much damage this can cause. But malware is not only a threat to a company's turnover and reputation. NotPetya first appeared in Russia and Ukraine and was soon discovered on computers at the damaged Chernobyl nuclear power plant, as reported by Heise magazine. Due to the computer failure, radioactivity had to be checked manually, as the magazine further reported, citing the exclusion zone administration.