Massimo Rocca is the Head of Information Security, Italy for Enel Group (Enel). The Italy-headquartered Group and three other leading European utilities will be the Founding Utility Members of EE-ISAC. As EE-ISAC will be launched in December 2015, the actual data & experience sharing will officially start in a few weeks. However, the run-up period has already brought Enel a wealth of cyber security insights, as Massimo explains in the interview below.
“EE-ISAC’s success in challenging cyber threats is strictly
related to access to updated and comprehensive information.”
- EE-ISAC is the main deliverable of the DENSEK Project. Enel was already involved in the DENSEK Project and now will be among the Founding Members of EE-ISAC. What made Enel decide to participate already at such an early stage?
Enel has been working heavily on ICS security and critical infrastructure protection at least since 2008. We realized from the very early days of the process that a standardization of organizational processes, technologies, architectures and interoperability is key to infrastructure resilience. Therefore, a single utility cannot afford to take up the cyber security challenge on its own, whatever its size.
As a result, Enel’s research and security teams launched several initiatives involving ICS and IT Security suppliers, acting as product testers at Enel’s Livorno lab, thus enhancing our expertise in the field as well as giving us the opportunity to strengthen our contacts with experts from other EU countries but also from outside the EU. These were the conditions that brought Enel to participate in the DENSEK project.
“No single utility can afford to take up the cyber security
challenge on its own, whatever its size.”
- Although officially launched during EUW15 in November, EE-ISAC stakeholders are already meeting regularly. Is Enel benefitting from the data and information shared via these meetings?
Our fellow experts participating in the meetings are all top specialists in their field, already involved in several international projects and task forces. So, yes, Enel Security Italy has already benefitted from several opportunities offered by the DENSEK and EE-ISAC activities. For instance, during the visit to an innovative project from one of our EE-ISAC partners we were allowed to collect some interesting inputs we shared with our colleagues at Enel’s headquarters in Rome.
Another time, I was requested by Enel to prepare an assessment of some features of our distribution networks and two fellow members from DENSEK, who are members of an international task force working on those kinds of assessments, provided me valuable information about those systems. Of course without breaching any confidentiality agreement, that goes without saying.
- Utilities need to be willing to share trusted information with each other and the private partners of EE-ISAC. How is Enel dealing with this?
EE-ISAC’s success in challenging cyber threats is strictly related to access to updated and comprehensive information. I believe that the only option is to build a trusted community as cyber intelligence sources are still struggling in the industry sector. We are already cooperating with government authorities to protect public safety. It seems equally reasonable to cooperate with private partners for the benefit of our businesses, exactly as EE-ISAC proposes.
From the data disclosure point of view, once the Terms of Reference are shared between members, it will be possible to share incident’s information. At the same time, Enel Security is reviewing information classification and incident management policies and procedures, in order to create organizational and technical interfaces to the security information sharing processes.
“We are already cooperating with the public authorities in this respect.
It seems equally reasonable to cooperate with private partners for
the benefit of our businesses, exactly as EE-ISAC proposes.”
Read more about EE-ISAC and it’s current group of stakeholders.
