Germany recommends eliminating direct internet access to PV plant control systems

Germany’s Federal Office for Information Security (BSI) has published cybersecurity recommendations to protect industrial control systems accessible via the internet. The agency strongly recommends securing networked control systems. The guidance targets operators of small and very small facilities, including hydropower plants, wind farms, waste-to-energy facilities and PV installations of all sizes.

The main recommendation is to eliminate direct internet access to plant control systems. In PV installations, these systems may include industrial controllers, communications equipment, monitoring gateways, inverters, supervisory control and data acquisition (SCADA) systems and remote monitoring platforms.

Connecting these systems directly to the internet increases their exposure to cyberattacks. Systems accessible via public networks may be vulnerable to unauthorized access attempts, exploitation of known security flaws or manipulation of operating parameters. The risks extend beyond the loss of monitoring data, as incidents affecting operational technology (OT) systems can disrupt plant control and operations.

The BSI recommends replacing direct internet access with secure remote connections using virtual private networks (VPNs) and multifactor authentication. VPNs establish encrypted connections between authorized users and plant networks, while multifactor authentication requires an additional form of identity verification beyond a password. Although these measures do not eliminate cybersecurity risks, they reduce the likelihood of unauthorized access resulting from stolen credentials or weak passwords.

The agency also recommends keeping equipment up to date and promptly installing security patches and software updates. This applies to supervisory systems and connected field devices, including routers, firewalls, controllers, inverters and communications gateways. Failure to install updates can leave systems vulnerable to known security flaws for which fixes are already available.

The BSI also calls for periodic checks to identify devices and systems exposed to the internet. Operators should maintain inventories of connected assets, identify their communications interfaces and verify that remote services are not unnecessarily accessible. When exposed systems are identified, operators should implement appropriate mitigation measures.

For PV plants, the recommendations underscore the importance of separating corporate and operational networks, restricting remote access to authorized users and service providers, and establishing regular update and security review procedures. The BSI recommends integrating these practices into routine plant operations to strengthen the cybersecurity of connected control systems.