IT security at INSYS icom
INSYS icom is a digitalisation expert for industrial data communication. With our core competences of remote maintenance, network technology and data transmission, we form the bridge between IT and OT. Our solutions are thus often the central gateway in the communication from closed and secure networks to the outside into the free internet. Especially for critical infrastructure players such as energy suppliers, heating networks, municipal utilities and power generation plants, the potential for damage is enormous. This makes them an attractive target for attackers, which is why the security of our solutions is the top priority.
Future-proof under the Cyber Resilience Act:
How can secure remote maintenance
be easily implemented?
» Secure introduction of VPN-based remote maintenance: How INSYS icom supports machine manufacturers with the Cyber Resilience Act «
Contents
- Secure remote maintenance in an increasingly networked industry
- Cyber Resilience Act
- Future viability through secure connectivity
- Increasing requirements due to regulations and their implementation
- Effects of the CRA for machine manufacturers
- Practical measures and investments in cyber security
- Secure solutions for CRA compliance
- Increased network security with icom OS
- Secure remote access with icom Connectivity Suite (iCS)
- Centralised device management with icom Router Management (iRM)
- Cyber Resilience Act – an opportunity for secure machine connectivity and new remote maintenance solutions
Request whitepaper now!
IT security features of our industrial routers
The most important IT security
of our products are summarised for you:
YOU are a lucrative target too!
Attacking systems in the first place can have various motives, even if they are not obvious at first glance.
Blackmail: disruption of production processes that is only lifted against payment of money
z. e.g. with the use of ransomware
Industrial espionage: Theft of business-critical information and know-how
Political motivation: attacks on critical infrastructure as part of a “cyber war”
Demonstration of power: inflicting maximum damage without a concrete goal
Demonstration of feasibility: attacks to improve the resilience of systems. Attackers are predominantly friendly and cooperative.
To protect our clients from such attacks, our IT security culture is characterised by the terms “security first”, “security by design” and “update it”:
„Security first“ – security as the basis of our actions
IT security plays a decisive role in every phase of our activities and in every product stage. The following five points form the cornerstones of our work:
„Security by Design“ – security from the very beginning
Our products are developed from the very beginning according to the principles of “Security by Design” and “Security by Default”. They are therefore characterised by the following points, among others:
“Update it” – Our update policy
Every product is only as secure as the updates it receives. Therefore, we at INSYS icom attach great importance to regular updates for our products:
icom OS router operating system
icom Connectivity Suite
icom Router Management
Vulnerability response & patch management
Deployment of patches for critical vulnerabilities (CVSS 9.0-10.0) immediately after availability
Patching of less critical vulnerabilities to the next scheduled release
Maintenance of a list of security advisories for CVEs (Security Advisories)
At home in critical infrastructures (KRITIS)
Critical infrastructures (CRITIS) are organisations or facilities with important significance for the state community. The requirements for the security of the products and services used there are naturally particularly high and are under constant observation. Our solutions for industrial data communication are ideally equipped to meet these requirements, which is why we are the market leader in Germany in the renewable energy and water/wastewater sectors.
LTE450 for critical infrastructures
In March 2023, INSYS icom launched an LTE450 industrial router series. Exclusively critical infrastructure players can access the fail-safe and nationwide mobile network.
Cybersecurity: protection against digital risks
Cybersecurity is legally required
The implementation of cybersecurity is no longer mandatory only for providers of critical infrastructure. With the EU Cybersecurity Strategy, a comprehensive framework has been established to effectively address cyber threats and ensure the reliable use of digital technologies.
They are implemented via several binding regulations that affect both providers and manufacturers. INSYS icom fulfils the applicable requirements and supports companies in the secure implementation of legal requirements. Our products are developed according to the ‘Security by Design’ principle, among others, and enable reliable, compliant operation of connected systems.
Overview of regulations
NIS 2
The NIS-2 Directive (Network and Information Security) defines binding requirements for the cyber security of critical infrastructures.
Radio Equipment Directive (RED)
The extended RED Directive sets out binding cybersecurity requirements for internet-connected radio equipment such as routers and IoT devices.
Cyber Resilience Act (CRA)
The Cyber Resilience Act (CRA) obliges manufacturers of digital products to ensure cyber security throughout the entire product life cycle.
How to keep your systems secure in five steps
With the following five tips, you can ensure that your systems and machines are securely networked:
Links, certificates and penetration tests
Here you will find material to support you in the KRITIS audit. You will also find an overview of penetration tests carried out as well as documentation and instructions for using INSYS icom products securely.
Links:
Documents:
Certificates:
Penetration Tests:
| Products tested | Test body | Period | Status/result |
|---|---|---|---|
| icom OS | Test by external security company | Q2 2025 | No critical or high vulnerabilities found. |
| icom OS | Customer test from the energy and automation technology sector | Q1 2025 | Vulnerabilities fixed. |
| icom OS | Customer test from the energy sector | Q1 2025 | Vulnerabilities fixed. |
| icom Connectivity Suite | TG Alpha | Q1 2025 | Vulnerabilities fixed. |
| icom OS | BSI / OpenSource Security GmbH | Q4 2022 | Security certificate issued. No vulnerabilities found. |
| icom Connectivity Suite | Customer test from the building technology sector | Q3 2021 | Vulnerabilities fixed. |
| icom Connectivity Suite | Customer test from the building automation technology sector | Q2 2021 | Vulnerabilities fixed. |
| icom OS | OpenSource Security GmbH | Q2 2021 | Vulnerabilities fixed. |
| icom Connectivity Suite | OpenSource Security GmbH | Q2 2021 | Vulnerabilities fixed. |
| icom Router Management | OpenSource Security GmbH | Q1 2021 | Vulnerabilities fixed. |
| icom OS | Customer test from the energy industry sector | Q1 2021 | Vulnerabilities fixed. |
| icom OS icom Data Suite | T-Systems on behalf of a customer | Q4 2019 | Vulnerabilities fixed. |
| icom Connectivity Suite icom OS | Customer test from the passenger transportation sector | Q3 2019 | "In conclusion, the system examined can be confirmed as having a generally high level of safety." |
| icom OS | Customer test from the plant engineering sector | Q2 2019 | Vulnerabilities fixed. |
IT Security – Frequently Asked Questions
Is there actually an exact definition of what high IT security means?
IT is very fast-moving and it would be hard to find a standard that considers the complexity of all use cases. Depending on the application, specifications would be over-secure or not secure enough. For this reason, IT security is usually defined relatively and not absolutely. Security organisations and industry associations therefore orient themselves to the state of the art, which is interpreted differently depending on the industry, the use case and also the size of the company. The industry-specific security standards (B3S) define for example, the state of the art for certain sectors. Technical guidelines such as BSI TR-02102 outline the state of the art for the use of cryptographic procedures.
The BSI IT-Grundschutz Compendium offers recognised recommendations for action and is regarded as an established guide to the state of the art in IT security.
May only certified routers be used in critical infrastructures?
There are currently no regulations that prescribe or give preference to the use of certified components in critical infrastructures according to the BSI-KritisV. This may change in the future; in principle, CRITIS operators can use any components today, as long as they can prove compliance with the IT security requirements.
How objective is the proof of high IT security?
IT security can be proven on the one hand by independent penetration tests and on the other hand by state-recognised certificates. If tests and certifications are carried out by an officially recognised testing body, objectivity is guaranteed.
How does one prepare for an IT security audit?
For one thing, you can use the recommendations for the state of the art of the respective industry association or TeleTrust as a guide. We have also compiled a document for you with our recommendations for securing infrastructure. Our INSYS icom training team also offers security consulting as part of the extended support. Please feel free to contact us at: training@insys-icom.de
Contact form for safety instructions
Do you have questions about product IT security? Write a message to our ISB/CISO at security@insys-icom.com or use our secure online form