What kind of methodology does the EMRA maturity model present?

Savaş Ergen, Director of Infrastructure & Operations at CK Enerji, commented on the maturity model introduced by EMRA (Energy Market Regulatory Authority) as follows:

Security on the OT (Operational Technology) side is a valuable and significant issue within the energy sector. We witnessed instances where energy companies in Europe experienced service disruptions. Everyone’s first thought was: “Was this a cyberattack?” Upon closer inspection, however, it turned out not to be a cyberattack. Although the problem stemmed from a purely technical issue, it clearly demonstrated once again just how valuable, important, and indispensable electricity is to human life; hospitals and airports came to a complete standstill.

Consequently, the energy sector is a field that demands the sustainable management of critical systems. This is where the concept of OT comes to the fore. When looking at corporate structures, while security maturity levels on the IT side are high, the same level of maturity was unfortunately lacking on the OT side. However, we were excited by EMRA’s introduction of a maturity model and its aim to position OT security as a top priority for the energy sector, which manages critical infrastructure.

We are already addressing many of these issues, or striving to do so. Yet, this model provides a clear guide on exactly what needs to be done. The first principle of management is mastering your inventory. On the OT side, this is more challenging than on the IT side because you are dealing with sensors at the edge points. You must first make these sensors visible and then close the security gaps arising from vulnerabilities within the inventory.

Subsequently, methods used in IT need to be adapted for application in OT. From a technical standpoint, we utilize systems like EDR (Endpoint Detection and Response) and NDR (Network Detection and Response) in OT environments to detect anomalies; the structures employed in IT can also be applied to the OT side. Once these measures are in place, we are able to automatically block potential attacks. The EMRA maturity model presents a methodology that runs exactly parallel to this process. This strengthens our position, enabling us to take appropriate actions and implement solutions on the OT side as well.