@A6K - Charleroi

2
Programme
• 09h30 Mot de bienvenue - Cluster H2O / INFOPOLE Cluster TIC
• 09h35 Cybersécurité
• Points d’attention pour la sécurisation des infrastructures - Cynthia Collinet et Victor
Tavernier, Redsystem
• Facteurs critiques de cybersécurité dans l'industrie de l'eau au Royaume-Uni –
Emmanuel Boucquey, CGI
• 10h10 Protocoles de communication et hébergement des données
• Tour d'horizon des solutions disponibles – Vincent Jassogne, NRB
• Compteurs intelligents et réseau Lora – Bernard Michaux et William De Angelis, CILE
• Use case Brasserie Lefebvre - Jean-Philippe Vermeulen, Technord
• 11h20 Visite de l'A6K avec Abd-Samad Habbachi (A6K-E6K) et du supercalculateur Lucia
avec Kevin Mailleux (Cenaero)
• 12h15 Lunch networking

3
Orateurs

Digitalisation dans
le secteur
de l’eau
Infopole. Cluster H2O & REDSYSTEM

Des entreprises ont déjà subies une
cyberattaque
Des attaques commencent par un mail
de phishing
De ces entreprises
ont fait faillite
QUELQUES CHIFFRES

Qu’est-ce qu’une
Cybermenace ?
Disponibilité
Une cybermenace est une activité qui
vise à compromettre la sécurité d’un
système d’information en altérant un
ou plusieurs de ces 3 principes :
Intégrité Confidentialité
CYBERMENACE

GAIN FINANCIER
Les attaquants peuvent essayer de voler des données sensibles
telles que des informations de carte de crédit ou des
informations de connexion qu'ils peuvent utiliser pour voler de
l'argent auprès de particuliers ou d'organisations.
ESPIONNAGE
Les gouvernements, les entreprises et d'autres organisations
peuvent lancer des cyberattaques pour recueillir des
renseignements auprès de leurs rivaux ou concurrents.
Compliance
SABOTAGE
Les cyberattaques peuvent également être utilisées pour
saboter les opérations d'une entreprise ou d'une organisation.
Les attaquants peuvent cibler des systèmes critiques tels que
les réseaux électriques, les approvisionnements en eau ou les
réseaux de transport.
Compliance
RANCŒUR PERSONNELLE
Parfois, des individus lancent des cyberattaques contre des
personnes ou des organisations car ils ont une rancœur
personnelle. Ils peuvent le faire pour nuire à leur réputation ou
causer des dommages financiers.
HACKTIVISME
Certains individus ou groupes lancent des cyberattaques pour
promouvoir un programme politique ou social. Ils peuvent
défigurer des sites web, divulguer des informations sensibles
ou perturber des services en ligne.
RANCONGICIEL
Les cybercriminels peuvent lancer des attaques de rançongiciel
afin de demander un paiement en échange de la restauration
de l'accès aux données ou aux systèmes d'une victime.
ENJEUX

IMPACT FINANCIER
Perte de clients et de CA, perte boursière,
paiement de rançon, réparation de matériels
informatiques (perte de trésorerie), appels à
des fournisseurs externes, etc..
Compliance
IMPACT SUR L’IMAGE DE L’ENTREPRISE
Réputation mise à mal, mauvaise publicité, céder
aux chantage, etc..
IMPACT ORGANISATIONNEL
Paralysie des systèmes, désorganisation des
équipes internes, retard ou arrêt de
production, etc..
IMPACT JURIDIQUE ET REGLEMENTAIRE
Contentieux mettant en cause la responsabilité de
l’entreprise, amende pour non respect des lois
(RGPD), fuite de données, espionnage, etc...
IMPACT TECHNIQUE
Pannes ou arrêt des serveurs, intrusions,
Botnets, etc
IMPACT HUMAIN
Stress, chômage technique, atteinte à la vie
privée, etc..
IMPACTS

MALWARE
INGENIERIE SOCIALE
PHYSIQUE
ATTAQUES DDoS
MAN-IN-THE-MIDDLE
USURPATION
D’IDENTITE
INTERCEPTION DANS LA
COMMUNICATION
ANONYMOUS
PHISHING
RANSOMWARE
TYPES
D’ ATTAQUES

EXEMPLE
INTRUSION SUR
SITE

RESILIENCE / BACKUP
Aujourd’hui, même les plus grandes entreprises résistent difficilement aux attaques informatiques. L’enjeu n’est donc pas de blinder votre infrastructure, mais
plutôt de la remettre sur pied le plus vite possible après une attaque.
Pour ça, il faut avant tout identifier les éléments essentiels au redémarrage de votre entreprise. Il peut s’agir de votre site, de votre base de données client, de
votre ERP…
Une fois ces éléments identifiés, il faut ensuite mettre en place un processus de sauvegarde récurrente des données essentielles, reposant sur le principe du 3-2-1
:
3 copies de vos données ;
2 supports de stockage différents ;
1 copie de la sauvegarde en dehors de l’entreprise.
Régulièrement effectuez des tests de restauration pour vous assurer que tout fonctionne.
DIRECTIVE DE
DIGITAL WALLONIA

SECURITY BY DESIGN / AUDIT
Il n’existe aucune solution miracle pour une cybersécurité à toute épreuve… Mais en envisageant cela comme un travail de fond, vous mettez toutes les chances de
votre côté. Une bonne option, notamment lors de la mise en place d’un nouveau projet, est d’utiliser le concept de "Security By Design".
Il s’agit de privilégier l’intégration de la sécurité dès la première étape du projet. L’idée est de résoudre les questions de sécurité de manière préventive plutôt que
de devoir y répondre plus tard dans l’urgence.
Cela demande un peu plus de travail en amont, mais vous éviterez bien des frais et des dégâts ensuite.
Pour les projets existants et l’infrastructure informatique en général, effectuez un audit de sécurité annuel. Vous identifierez ainsi les failles éventuelles pour les
résoudre de manière durable
RANSOMWARE
Imaginez : vous recevez un email contenant une facture au format PDF d’un fournisseur. Sans y prêter attention, vous cliquez dessus. Rapidement, vous vous rendez
compte que cette facture n’a rien à voir avec vous et n’y pensez plus. Un peu plus tard, tous vos fichiers sont inaccessibles : vous êtes victime d’un ransomware, ou
rançongiciel en français.
Pour récupérer vos données, vous avez deux options :
Soit vous payez la rançon demandée, sans aucune garantie de retrouver effectivement vos données ;
Soit vous restaurez une sauvegarde saine, antérieure à l’attaque.
Vous l’aurez compris, la seule option viable est de sauvegarder régulièrement vos données !
DIRECTIVE DE
DIGITAL WALLONIA

POLITIQUE DE SECURITE / TRAINING
À l’ère du numérique, la cybersécurité est devenue un enjeu crucial pour les entreprises. Il est donc important de mettre en place des processus de gestion de la
sécurité et de les résumer dans une politique de sécurité informatique.
Ce document reprend les informations essentielles pour permettre aux employés de savoir ce qu’ils peuvent faire ou non avec le matériel informatique, mais aussi
comment réagir en cas d’attaque.
Veillez à rendre ce document accessible et digeste car il doit être adopté par le personnel. Les employés sont en effet la première cause d’incidents
informatiques… Mais un personnel correctement formé sera également votre meilleur rempart !
PHISHING
Sur internet, les escrocs regorgent d’imagination pour vous piéger, comme avec la méthode du phishing, ou hameçonnage en français.
La stratégie est de se faire passer pour un organisme connu : banque, administration, marque… et de vous envoyer un mail demandant de « mettre à jour vos
informations ». L’idée est ici de vous faire introduire vos données sensibles pour vous les dérober ensuite.
Évidemment, il ne faut absolument pas réagir à ces e-mails. Soyez toujours vigilant, surtout lorsque vous ne connaissez pas l’expéditeur ou que les demandes
vous semblent étranges.
Pour lutter contre le phishing, la prévention reste la meilleure option : implémentez un outil d’analyse des mails et formez vos collaborateurs.
DIRECTIVE DE
DIGITAL WALLONIA

La Red Team chargée de tester la sécurité
d'un système en simulant des attaques,
dans le but d'identifier les vulnérabilités et
les faiblesses du système.
REDSYSTEM. utilise des techniques
d'attaque réalistes pour simuler des
scénarios d'attaques réelles, telles que des
attaques de phishing. L'objectif est de
détecter les vulnérabilités avant que les
attaquants réels ne les exploitent.
Red Team
RED TEAM

Pourquoi faire appel à des experts tels que
REDSYSTEM. ?
Expertise
Approche
proactive
Evaluation
des
risques
Conformité
Réponse
à
incidents
Sensibiliser
et former
le personnel
EXPERTS

Blue Team
La Blue Team travaille à renforcer la
sécurité du système en utilisant des
techniques de surveillance, de détection
et de réponse aux incidents de sécurité.
En d'autres termes, l'équipe Blue Team
est responsable de la sécurité
opérationnelle et de la défense en
profondeur du système.
BLUE TEAM

Pourquoi faire appel à des experts tels
qu’une BLUE TEAM ?
Création de
réseaux
sécurisés
Maintenance
du parc
informatique
Mise en place
de solutions
backup
Analyse
Gestion
des comptes
utilisateurs
Mise en place
d’un plan de
continuité
d’activité
EXPERTS

Améliorer ce que
l’on peut contrôler

Insights into Critical
Cybersecurity Factors
in the UK Water Industry
Emmanuel Boucquey
VPCS Energy, Utilities & Telco, CGI Belgium

© 2023 CGI Inc. 2
Miguel Moors
Security Expert
Emmanuel
Boucquey
Vice President
Energy, Utilities &
Telco
Around the table

© 2023 CGI Inc. 3
CGI at a glance
Founded in 1976
46 years of excellence
CA$12.9 billion revenue
90,000 consultants
400 locations in 40 countries
5,500 clients benefiting from
end-to-end services

© 2023 CGI Inc.
Access to the right skills, right locations, at the right time, and the right price
Our global delivery model complements our proximity model
to offer end-to-end capabilities
4
experts
delivery centers
technology centers

© 2023 CGI Inc.
45 Years of Cybersecurity Services
1,700+
Experienced and credentialed security specialists
combine their proficiency in best-of-breed tooling and
industry-recognized concepts to deliver relevant advice to
fit your unique needs
43 million
Cyber attacks we protect against each day on military
and intelligence networks and infrastructure
10
Security Operations Centers globally delivering around-
the-clock cyber detection and prevention services to
business and government clients
5
United Kingdom
Nordics Australia
Benelux Germany France
Canada U.S.A. West

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
6
01 02 03 04 05

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
7
01 02 03 04 05

© 2023 CGI Inc.
About the UK Water Industry
A crucial function in supporting public health and the
environment, and vital part of UK infrastructure.
› Clean drinking water and treating wastewater for
around 66 million people across England, Scotland,
Wales, and Northern Ireland.
› Regulated by government agencies, with oversight
provided by OFWAT (the Water Services Regulation
Authority) in England and Wales, the Water Industry
Commission for Scotland, and the Utility Regulator in
Northern Ireland.
› Several large water companies, including Anglian Water,
Severn Trent Water, Thames Water, United Utilities,
Yorkshire Water, and Scottish Water.
These companies are responsible for managing and maintaining the
water supply infrastructure, including reservoirs, treatment plants, and
distribution networks. They also manage the sewerage infrastructure,
which includes wastewater treatment plants and sewer networks.
› In addition to the water companies, there are also a
number of smaller independent water suppliers, which
provide services to specific regions or communities.
8

© 2023 CGI Inc.
Key challenges today
› Aging infrastructure
› Changing weather patterns
› Increasing demand
due to population growth
The industry is also under pressure
› To reduce costs
› To improve efficiency
› While maintaining high standards of
water quality and environmental
sustainability
9

© 2023 CGI Inc.
Water
treatment
plants
Treating and purifying
raw water to make it
safe for human
consumption. They may
include filtration
systems, chemical
treatment processes,
and disinfection
measures.
Reservoirs and
water storage
tanks
Used to store treated
water before it is
distributed to customers.
They may be located
above or below ground
and may be made of
concrete, steel, or other
materials.
Water
distribution
networks
Pipes and valves used
to transport water from
treatment plants to
homes and businesses.
These may be
connected to multiple
water sources and may
include pump stations
and other infrastructure.
Sewage
treatment
plants
Treating and disposing
of wastewater and
sewage. They may use
biological, chemical, or
physical processes to
remove pollutants and
contaminants from
wastewater.
Flood control and
management
infrastructure
Managing flood risk and
controlling water levels in
rivers and other water-
ways. This may include
use of dams, levees, and
other infrastructure to
manage water flow and
prevent flooding.
Key elements include…
10
Understanding the British Water Industry

© 2023 CGI Inc.
Relevant regulations include…
›
Regulating public water supplies in England and Wales, ensuring that drinking
water is safe, clean, and of sufficient quality. Water companies must comply with
the Water Supply (Water Quality) Regulations, which set strict standards for
water quality and supply.
›
Requiring water companies to obtain permits for certain activities, such as
discharging wastewater into waterways or operating treatment plants.
›
Requiring operators of essential services, including water companies, to
implement appropriate cybersecurity measures to protect against cyber threats
and incidents.
›
Standards for the collection, processing, and storage of personal data, including
customer information collected by water companies.
›
Rules and standards for water companies related to customer service,
pricing, and performance.
›
Compliance with health and safety regulations to protect employees and the
public from risks related to their operations.
›
Establishes requirements for water companies related to pollution prevention
and control.
11

© 2023 CGI Inc.
›
Systems to remotely monitor and control a wide range of equipment and
processes, such as pumps, valves, and chemical dosing systems for water
treatment and distribution processes.
Given the critical importance, these systems are also a prime target for
cyberattacks. Water companies must therefore implement appropriate
cybersecurity measures to protect their SCADA systems from unauthorized
access and ensure their continued operation in the event of a cyber incident.
›
Systems used to automate and control a wide range of industrial processes,
including those involved in water treatment and distribution.
Attackers who gain access to an organization’s IACS may be able to manipulate
or disrupt industrial processes, leading to significant operational and safety risks.
›
Devices used to collect and transmit real-time data from a wide range of
sources, including sensors and monitoring equipment.
If not properly secured, IIoT devices can be vulnerable to cyberattacks, which
could potentially compromise the security and integrity of a water company's
systems, data, operation and services.
Water companies must ensure that appropriate cybersecurity measures are in
place to protect their assets, equipment and systems from unauthorized access,
including robust authentication and encryption protocols, regular software
updates and patches, and ongoing monitoring and vulnerability assessments.
Relevant systems include…
12

© 2023 CGI Inc.
In summary…
To address these challenges, the UK water industry is investing in cybersecurity measures such as network monitoring, threat
intelligence, and employee training. Regulatory bodies such as Ofwat are also increasing their focus on cybersecurity and requiring
water companies to demonstrate that they have appropriate measures in place to protect their systems and data.
Some of the specific cybersecurity challenges facing the UK water industry include:
13
Ransomware attacks
A type of malicious software that
encrypts data on a victim's
computer systems and demands
payment in exchange for the
decryption key.
Several UK water companies
have been targeted by
ransomware attacks in recent
years.
Advanced persistent
threats (APTs)
Targeted, long-term attacks by
sophisticated hackers who
seek to gain unauthorized
access to critical systems and
steal sensitive information.
In recent years, there have
been reports of APT attacks on
UK water companies.
Supply chain risks
The UK water industry relies on
a complex network of suppliers
and contractors to provide
equipment, software, and
services. These third-party
providers may have their own
cybersecurity weaknesses that
can be exploited to gain access
to water company systems.
Legacy systems
and equipment
Many water treatment and
distribution systems were
built decades ago and are
still in use today. These
legacy systems may have
vulnerabilities that can be
exploited by cybercriminals.

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
14
01 02 03 04 05

© 2023 CGI Inc.
Impact of Brexit and Liberalization of the UK Water Industry
›
As a result of Brexit, the UK is no longer part of EU's Network and Information Security Directive (NIS Directive)
and the Cybersecurity Act initiatives developing its own domestic cybersecurity regulations and frameworks.
In terms of the water industry specifically, the UK's departure from the EU may have some impact on information
sharing and collaboration on cybersecurity issues with water in other EU member states.
However, there are still opportunities for collaboration with international partners outside of the EU, and the UK
government and regulatory bodies continue to emphasize the importance of cybersecurity in the water industry.
› following market liberalization has made
cybersecurity a more challenging issue to address. The different players in the water supply chain, such as water
retailers, wholesalers, and third-party providers, may have different levels of cybersecurity maturity and awareness,
making it difficult to ensure a consistent approach to cybersecurity across the industry.
Regulatory bodies such as OFWAT have placed a greater emphasis on cybersecurity in their regulatory
frameworks in response to the changing landscape of the industry.
15

© 2023 CGI Inc.
BE vs. UK water industry
Some similarities exists, such as water supply,
treatment, and distribution, as well as the need for
effective management of water resources and
infrastructure. Notable differences include:
›
UK water industry is primarily owned by private
companies whereas Belgium water industry is
primarily publicly owned and operated by local
municipalities or inter-municipal companies.
›
UK water market was liberalized in 2017, allowing
businesses and other non-household customers to
choose their water supplier. In Belgium, there is no
such market liberalization (yet), and the industry is
structured around local municipalities or inter-
municipal companies.
16

© 2023 CGI Inc.
BE vs. UK water industry
Continued…
›
In the UK water companies are regulated by the Water
Services Regulation Authority (Ofwat), which sets price
controls and other regulatory requirements
In Belgium there are various levels…
• National level, where the Federal Ministry of Public Health,
Environment and Nature is responsible for setting water
quality standards and regulating drinking water supply.
• Regional level, where three regions have their own
authorities for water management, incl. wastewater
treatment, flood prevention and water resource management.
• In Flanders, the Flemish Environment Agency (Vlaamse Milieu
maatschappij) is responsible for water management
• In Wallonia, the Public Service of Wallonia (Service Public de
Wallonie) is the responsible authority for water management
• In Brussels-Capital, the Brussels Environment agency (Bruxelles
Environnement) is responsible for water management.
Local municipalities also play a role in the local water
industry, as they may be responsible for providing drinking
water to residents and maintaining local water infrastructure
17

© 2023 CGI Inc.
BE vs. UK water industry
Continued…
›
The UK and Belgium have different geographies and
climates, impacting the water industry. For example,
the UK has higher levels of rainfall than Belgium, which
impacts supply and treatment needs. Additionally, the
UK has a more extensive coastline, which impacts the
management of marine environments and coastal
flooding risks.
›
The UK and Belgium have different approaches to
technology and innovation in the water industry. For
example, the UK has invested in new technologies
such as smart metering and real-time monitoring to
improve water management and reduce leakage. In
Belgium, there has been a focus on the development
of innovative wastewater treatment technologies.
18

© 2023 CGI Inc.
Relevant innovation in the
Belgium water industry
›
This initiative aims to develop a real-time monitoring
system for the water distribution network, using
sensors and data analytics to detect leaks and
optimize water usage. The project is being conducted
by the Flemish Environment Agency (Vlaamse Milieu
maatschappij) in collaboration with several other
partners, including water utilities and technology
companies.
›
Several projects underway to develop innovative
technologies for water quality monitoring, including:
› Ephyto project to develop a sensor system to
monitor pesticide levels in waterways.
› Aquavalens project developing new methods for
detecting and preventing waterborne diseases.
19

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
20
01 02 03 04 05

© 2023 CGI Inc.
OT environments in general are not secure
Insecure “by design”
ICS systems are designed for
high availability, not for security
• Flat architecture
• Limited authentication
• Outdated Technology
• Infrequently patched
High connectivity
Modern ICS networks become
more complex, and connected to
the outside world
• Remote access
• IT/OT connectivity
• IIoT/ Industry 4.0
Lack of visibility
Assets, commands and
communications
• Multi-vendor environments
• Layers stacked over years
• Lack of OT monitoring
21

© 2023 CGI Inc.
What are the most common
OT Protocols in the industry?
Widely used in industrial automation and control systems
(IACS) for communication between devices, such as
programmable logic controllers (PLCs) and sensors
Used for communication between devices in the electric and
water utility industries
For communication between devices in manufacturing and
process control systems
For communication between devices in industrial control and
automation systems
For communication between devices in building automation
and control systems
22

© 2023 CGI Inc.
›
Many OT protocols do not include strong authentication
and authorization mechanisms, making them vulnerable to
unauthorized access and manipulation by cyber attackers.
›
Many OT protocols do not include encryption or use weak
methods, making them vulnerable to eavesdropping and
other attacks.
›
Many OT devices and systems run outdated software and
firmware, making them vulnerable to known vulnerabilities
that could be exploited by attackers.
›
Poor network segmentation between IT and OT networks
can make it easier for attackers to gain access to OT
devices and systems. A malware attack may also spread
more easily.
›
Many OT devices and systems have limited visibility and
monitoring capabilities, making it difficult to detect and
respond to cyber attacks.
›
Most OT protocols were designed without security
considerations in mind, making them vulnerable to
exploitation by attackers.
›
Many OT devices and systems do not receive regular
security updates and patches, leaving them vulnerable to
known vulnerabilities.
›
Because of the age of many OT environments next gen
Security Iincident and Event Monitoring tooling is often a
challenge to integrate. This means that some OT
infrastructure is either not monitored or the connection of
OT elements introduces such risk that it negates its
purpose.
What are the most common vulnerabilities in OT Protocols, today?
23

© 2023 CGI Inc.
Recent attacks in the UK
water industry
›
[May 2021] Ransomware attack affecting its customer service systems,
but not impacting operational systems, and no customer data was
compromised.
›
[March 2020] Cyberattack that impacted its IT systems. The company
did not disclose the nature of the attack or any further details.
›
[2019] Fined £146K by the Information Commissioner's Office (ICO) for
a data breach that occurred in 2017. The breach involved a third-party
contractor who accidentally exposed customer data on an unsecured
server. The ICO found that Anglian Water had failed to adequately
oversee the contractor's security practices.
›
[2018] Fined £200K by the ICO for a data breach that occurred in 2015.
The breach involved a company laptop stolen containing unencrypted
customer data. The ICO found that Yorkshire Water had failed to have
appropriate measures in place to protect the data on the laptop.
›
[2022] The South Staffordshire PLC, suffered a Clop ransomware attack
The cybercrime gang claims it compromised Thames Water, the largest
water utility and sewerage treatment facility serving Greater London and
surrounding areas.
24

© 2023 CGI Inc.
+ an overseas example
›
Around 8 AM on Friday morning February 5, 2021 an employee of
a water treatment plant in this 15,000-person city, noticed that his
mouse cursor was moving strangely on his computer screen, out
of his control, as local police would later tell it.
Initially, the employee wasn't concerned; the plant used remote-
access software TeamViewer to allow staff to share screens and
troubleshoot IT issues, and his boss often connected to his
computer to monitor the facility's systems.
But a few hours later, police say, the plant operator noticed his
mouse moving out of his control again. This time there would be
no illusion of benign monitoring from a supervisor or IT person.
The cursor began clicking through the water treatment plant's
controls. Within seconds, the intruder was attempting to change
the water supply's levels of sodium hydroxide, also known as lye
or caustic soda, moving the setting from 100 parts per million to
11,100 parts per million. In low concentrations the corrosive
chemical regulates the PH level of potable water. At high levels, it
severely damages any human tissue it touches.
25

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
26
01 02 03 04 05

© 2023 CGI Inc.
What are key steps in assessing your cybersecurity maturity?
27
1 2 3 4 5 6
Conduct a risk
assessment
To identify potential threats,
vulnerabilities, and risks to critical
systems and data. This can include
reviewing existing policies and
procedures, interviewing key
stakeholders, and conducting
technical assessments of systems
and networks.
Evaluate existing
cybersecurity
controls
To mitigate risks and vulnerabilities.
This can include reviewing access
controls, data protection measures,
incident response plans, and
business continuity plans.
Evaluate employee
training and awareness
programs
To ensure that employees
understand their role in maintaining
security and are aware of risks and
threats that they may face.
Evaluate existing training and
awareness programs and identify
opportunities for improvement.
Develop a roadmap for
improvement
To improve cybersecurity maturity,
based on the results of the
assessment. This may include
implementing new technical
controls, improving policies and
procedures, and increasing
employee training and awareness.
Conduct vulnerability
assessments and
penetration testing
To identify weaknesses in systems
and networks that could be exploited
by attackers. This can include
conducting penetration testing,
vulnerability scanning, and social
engineering testing.
Review compliance with
regulatory requirements
Review compliance with e.g. General
Data Protection Regulation (GDPR)
and the Network and Information
Systems Regulations (NIS).
requirements and identify any gaps or
opportunities for improvement.
Then…
Implement
mitigating measures
To reduce the risk of
cyberattacks and protect
their systems and data.

© 2023 CGI Inc.
There are several appropriate mitigating measures…
›
E.g. vulnerability assessments and penetration testing,
help identify potential weaknesses in a company's systems
and processes, allowing them to take action to address
these vulnerabilities
›
Employees are often the weakest link in an organization's
cybersecurity defenses. Regular training and awareness
programs help employees understand the importance of
cybersecurity and best practices for protecting sensitive
information
›
Dividing a company's network into smaller segments with
restricted access help prevent attackers from gaining
access to critical systems if they breach one segment, and
stop a malware event from spreading easily
›
Requiring users to provide multiple forms of identification,
such as a password and a security token, makes it harder for
attackers to gain unauthorized access to systems
›
Keeping software and systems up to date help prevent known
vulnerabilities from being exploited
›
Developing a plan that outlines steps to take in the event of a
cyberattack help minimize impact of an attack and speed up
the recovery process
›
Conducting due diligence on third-party vendors and
contractors help ensure appropriate security measures are in
place and are not introducing additional risk to systems.
Some examples:
28

© 2023 CGI Inc. 29
A Business Continuity Plan (BCP) is a critical component of an
organization's cybersecurity strategy
Here are some key elements of an effective BCP plan
Define critical
business
functions
Conduct
a risk
assessment
Develop a
response plan
Establish
backup
systems and
redundancies
The first step in
developing a BCP is to
identify and prioritize
critical business functions
that must continue to
operate in the event of a
disruption.
For the UK water industry,
this might include
processes such as water
treatment and distribution,
customer service, and
billing.
A risk assessment can
help identify potential
threats and vulnerabilities
to critical business
functions, as well as the
potential impact of a
disruption. This
information can be used
to develop appropriate
risk mitigation strategies.
A response plan should
outline the steps that will
be taken in the event of a
disruption, including the
activation of a crisis
management team,
communication protocols,
and any necessary
operational changes to
ensure critical business
functions can continue to
operate.
Backup systems and
redundancies can help
ensure that critical
business functions can
continue to operate in the
event of a disruption. This
might include backup
power supplies,
redundant network
connections, and
duplicate data storage
systems.
Test
the plan
Review and
update the
plan regularly
Regular testing and
simulation exercises can
help ensure that the BCP
is effective and can be
implemented quickly and
efficiently in the event of a
disruption. This may
include tabletop
exercises, mock drills,
and full-scale simulations.
The threat landscape is
constantly evolving, and
the BCP must be
reviewed and updated on
a regular basis to ensure
it remains effective and
relevant.

© 2023 CGI Inc.
Misc.
Q&A
Next steps
Cybersecurity
resilience /
maturity
Including key measures,
BCP/DRP and relevant
CGI solutions
Vulnerabilities
in Operational
Technology
Including examples and
recent attacks
Other relevant
perspectives
Including relevant
Operational Technology
+ Regional and Local
developments
Overview &
Key Challenges
Including latest industry-
related regulatory
developments
Agenda for today
30
01 02 03 04 05

© 2023 CGI Inc. 31
CGI in Energy & Utilities
Downstream
Midstream
Upstream
Refining &
Chemicals
Storage
Renewables
Wholesaling /
Retailing
Transmission
Distribution
Production
Billing
Energy
Market
Financial
Settlement
We have ~7,500 Energy & Utilities
consultants worldwide
1,000+ upstream applications
supported for Oil & Gas
250 million fuel card transactions
processed every year
650 clients globally
23 industry software IP solutions
14 markets systems in 10 countries
57 million managed smart meters

© 2023 CGI Inc. 32
CGI capabilities in Energy & Utilities

© 2023 CGI Inc.
CASE STUDY
CGI’s security solutions for IT/OT domain
Critical infrastructure and processl
cyber resilience
Value delivered
33
Cyber security, IT/OT,
Country: Global
Industry: Energy, Utilities and
Manufacturing
• 1,700+ cybersecurity experts
providing in-depth knowledge and
best practices
• 50+ OT security Experts
• 20+ GICSP Certified Experts
training our own members and
customers
• 3 accredited security certification
facilities in Canada, the UK and
US | 8 Security Operations
Centres located globally
CGI enables companies to reduce security risk and avoid loss in data,
visibility and control by protecting operations from damage. Using
Cybersecurity Assessment and Advisory Services for securing
industrial automation, control systems and critical infrastructure (ICS,
SCADA, BMS). Solutions to secure and monitor internet-enabled
devices cover e.g. electricity grids, power plants, water treatment &
distribution, oil & gas fields, production, storage utilising SECURE-ICS
family of cybersecurity methods, tools, materials & services.

© 2023 CGI Inc.
Cyber Assessment Framework
NCSC’s Cyber Assessment Framework
(CAF) is an established framework that
maps to security standards (i.e. ISO
27001) and assesses cybersecurity
maturity for an organization providing
essential services.
This framework contains 14 Principles with 39
Indicators of Good Practice to evidence what is
being done, and what needs to be done to become
a cyber resilient organization, complying to the NIS
Directive, contributing to Cyber Resilient UK and
ultimately protecting systems and data for a
dependent community.
34
“Assessment of contributing outcomes is primarily a
matter of expert judgement and the IGP tables do not
remove the requirement for the informed use of cyber
security expertise and sector knowledge”

© 2023 CGI Inc. 35
Siren360: Monitoring et Anticipation d’évènements
Siren360, fonctionnant avec MapLarge, est une plateforme interactive en temps réel d’analyse,
d’affichage, d’alertage et de compte rendu, utilisant des données massives. Agile, simple à
intégrer et performante, elle peut être utilisée dans tous les secteurs d’activité, soutenant les
stratégies d’entreprise grâce à la transformation numérique, la gestion des risques, l’efficacité
opérationnelle, et plus encore.

© 2023 CGI Inc.
CASE STUDY
Contact: Sian.Gardner@cgi.com
Developing the Central Market
Operating System (CMOS) for the non-
household water market in England
Value delivered
The solution enabled competition for
1.2 million customers. Allowed those
customers to benefit from:
• Lower bills
• Innovative new services, and
• Improved customer service
• CMOS supported an active
market. There were over 100,000
supplier switches within the first
ten months alone. 64 different
organisations used the system,
and CMOS calculated £2.4 billion
of settlement charges a year.
36
Water; Utilities; MOSL (Market
Operator Services LTD)
Country: UK North and Australia
Industry: Utilities
.
CGI has been at the heart of every major change in Britain’s energy
market since privatisation and has brought technological innovation to
the UK water sector for over 30 years. We have designed and built 14
central market systems in 10 countries, leading the market in the
provision of the technology that enables utility markets to operate
effectively; including the BSC Settlement systems for ELEXON in the
UK. Enabling a competitive water market has won CGI the Water
Industry Awards 2018 for Alliancing and Partnership Initiative of the
Year.

© 2023 CGI Inc. 37
CGI SensorInsights360 is a flexible real-time data platform that
delivers an end-to-end approach to Internet of Things (IoT), asset
data collection and asset management.

cgi.com/belgium
Insights you can act on
At CGI, we are insights-led and outcome-based
to help clients accelerate returns on their
investments.

© 2023 CGI Inc.
Proprietary and Confidential
All rights reserved. The information contained in this document is
confidential to CGI and to the receiving party. This document, or any
portion thereof (including, without limitation, text, artwork, images,
tables or other materials) may not be reproduced, distributed, printed
or used in any form or by any mechanical or electronic means,
including electronic archival systems, without the written approval of
CGI, except for the purpose it has been explicitly provided.
If you have received this document by mistake, note that the reading,
the reproduction or the distribution of this document is strictly
forbidden.
Brand- or business names and logos used in this document are the
property of the respective companies.

© 2023 CGI Inc.
Sources
› “CGI’s security solutions for IT/OT domain | Critical infrastructure and process” by CGI Cyber security, IT/OT
› “RMS: Renewables Management System SCADA and analytics software for multiple renewables sources” by CGI
› “Using the Cyber Assessment Framework in a multi-tenant CNI risk landscape” by CGI
› “Beyond Critical National Infrastructure (CNI) How CNI-like organizations can benefit from appropriate application of the Cyber Assessment Framework (CAF)” by CGI
› "Cybersecurity for Industrial Control Systems" by the National Institute of Standards and Technology (NIST)
› "Cybersecurity in the Water Sector: Guidelines for Risk and Resilience Management" by the European Union Agency for Cybersecurity (ENISA)
› "Cybersecurity in the Water and Wastewater Sector" by the United States Environmental Protection Agency (EPA)
› "Securing Operational Technology" by the Cybersecurity and Infrastructure Security Agency (CISA)
› "Assessing Cybersecurity in the Water Sector: Results from a Survey of Large Utilities" by the Water Information Sharing and Analysis Center (WaterISAC)
› "OT Security Best Practices" by Tripwire "Common Industrial Control System Vulnerabilities" by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)
› "Common Industrial Control System Vulnerabilities" by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)
› "Cyber Security for Water Utilities" by Water "The Cyber Threat to UK Energy and Water Supplies" by the UK National Cyber Security Centre (NCSC) "Guidance for Improving
Cyber Security in the Water Industry" by the Centre for the Protection of National Infrastructure (CPNI
› "Cyber Security in the Water Sector: Guidance on Developing a Risk Management Plan" by the Drinking Water Inspectorate (DWI)
› "Water Sector Cyber Security: Good Practice Guide" by the Water Information Sharing and Analysis Center (WaterISAC)
› "Water supply and water quality in the European Union" by European Environment Agency
› "Water management in Europe: Priceless benefits, but what’s the cost?" by Eurostat
› "Regulation of the Water Industry in England and Wales" by the House of Commons Library
› "Towards a smarter and more flexible water system: Ofwat's emerging strategy" by Ofwat
› "Flanders – a laboratory for sustainable and innovative water management" by Water Alliance
40

Cluster H2O
Digitalisation du
secteur de l’eau
15 – 03 - 2023
Protocoles de communication,
hébergement des données et
cybersécurité

La force d’un groupe
et la proximité d’une entreprise citoyenne
3300 collègues au sein du groupe
Top 3 IT en Belgique
35 ans d’expérience

3
NOS SERVICES
L E P O R T E F E U I L L E D E S E R V I C E S N R B
CONSEIL &
ACCOMPAGNEMENT
TRANSFORMATION
NUMERIQUE
MANAGED
STAFFING
MAINFRAME
INFRASTRUCTURE
DISTRIBUÉE &
CLOUD
SUITES
LOGICIELLES
DÉVELOPPEMENT
& INTÉGRATION
SÉCURITÉ DES
OPÉRATIONS

PILIER 2
Soins de santé
PILIER 3
Secteur public
local
PILIER 4
Moyennes
entreprises
PILIER 1
Public & social
Energie & utilités publiques
Finance & assurance
Organisations internationales
+ succursales de NRB au Luxembourg, en
Grèce et en Italie

Les principaux clients
Pillar 1
Public & social Finance & Insurance Energy & utilities Industry International org.

5G and Digital Platform – Unlock Value
Value
Time
Insight Latency Analysis Latency Decision Latency Action Latency
Insight about the event is
available
Analysis Completed
Counter Mesure
Approved Effect
Event

Value
Insight about the event is
available
Analysis Completed
Counter Mesure
Approved
Effect
Event
5G and Digital Platform – Unlock Value
Time
Insight
Latency
Analysis
Latency
Decision
Latency
Action
Latency

Value
Insight about the event is
available
Analysis Completed
Counter Mesure
Approved
Effect
Event
5G and Digital Platform – Unlock Value
Time
Insight
Latency
Analysis
Latency
Décision
Latency
Action
Latency
User
Experience Services
Ecosystem
IOT - Twins
AI &
Analytics
Network Latency

Your Customers
Core
Systems
Your Partners
Digital Platform
La plateforme Digitale

Les réseaux

Technologies de télécommunications
Réseaux
MESH
NFC
LPWAN (LoRa,
SigFox)
WIFI
Cellulaires (4G/5G)
RFID
Vitesse
Distance
Durée de la
batterie
Cas
d’utilisation
principaux
Entre 100 kbps
& 100 mbps
Entre 100 kbps
& 100 mbps
+/- 10 kbps +/- 250 kbps
Longue Longue
Courte Courte
Longue Longue
Moyenne
Moyenne
Géoloc 5G & nb-iot Bonne Moyenne
• Gestion des assets
• Smart Cities
• Smart Metering
• Voice & Data
Communication
• Smart Home
• Wearables & Smart
Health
• Smart City
• Smart Metering
• Tracking
• Smart Home
• HVAC
• Metering
• Lightning
Moyenne

Exemple de réalisation combinant plusieurs technologies
Réseaux
MESH
NFC
LPWAN (LoRa,
SigFox)
WIFI
Cellulaires (4G/5G)
RFID

Les échanges de données

Les APIs
Eco-système
DaaS API
External Dev API
Opendata
Une API (interface de
programmation
d'applications) est
simplement un logiciel qui
envoie des informations
dans les deux sens entre
un site web ou une
application et un
utilisateur.
Les API sont présentées
comme des produits que les
développeurs peuvent
utiliser pour construire votre
site ou votre application,
voire pour ajouter de la
valeur ou une nouvelle
façon de fournir de la valeur
aux systèmes que vous
construisez.

Exemple de réalisation sur Azure
Mise à disposition des données des Smart Meter et données de facturation sur une application mobile
La Plateforme Digitale propose des
API sur les systèmes opérationnels
permettant de rapidement
composer d’autres applications ou
construire de nouveaux systèmes.
L’écosystème regroupe alors les
données des compteurs
connectés, les données de
facturation et les données du
CRM.
La chaine de déploiement est
entièrement automatisée afin de
réduire le « Time To Market » et
garantir la qualité des produits
livrés
Eco-système
DaaS API
External Dev API
Opendata

IoT Twins & Stockage

Les jumeaux digitaux
Jumeaux
Digitaux
People
Car
Building
Drone
Smart Meters
• Un modèle précis des actifs physiques de production, de transmission et de
distribution, ou de la consommation d'énergie par les clients.
• Permettent d'imaginer comment les entités physiques peuvent et doivent se
comporter
• Utilisent des données existantes provenant de sources multiples et les rassemblent
pour les rendre plus faciles à interpréter et à utiliser par toutes les parties prenantes,
où qu'elles se trouvent
• Permettent de réduire le risque de pannes, de congestion en identifiant les goulets
d'étranglement dans le réseau.
• Permettent de réduire les coûts de maintenance grâce à l'analyse prédictive
• Accélèrent les demandes de raccordement des clients grâce à des calculs
automatisés de la capacité du réseau
• Rendre les données accessibles et compréhensibles pour toutes les parties prenantes
en démocratisant les données.

Home inspection
& maintenance
Utility efficiency
(water, energy)
Home security
Home assistance
& services
Personal health
Smart home &
comfort
• Camera,
• Intrusion detector,
• Smoke detector,
• Intelligent portal,
• Smart locks
• Smart meters
• Read head -
Monitoring gas,
elec. Water
• Optimisation of
consumption
• Smart thermostat
• Voice assistants
• Air quality (Temp, RH, C02,
Cov, Radon...)
• Intelligent shutters
• Big & small smart electrics
• Smart plugs
• Smart lamps
• Fall detection
• Sports advice & gym classes
• Pharmacy services
• Teleconsultation & diary
management
• Wellness & sleep trackers
• Connected Scales
• Connected health devices
(barometers, blood pressure
monitors,...)
• Connected glasses
• Connected pillboxes
• Installation &
maintenance of solar
panels
• Mandatory inspections
(audits, etc.)
• Pumping (leaks, spills,
etc.)
• Checking the boiler
• Maintenance of the wood
stove
• Installation/maintenance
of heating and air
conditioning systems ....
• Repairing water leaks
• Home cleaning services
• Home shopping
deliveries
• Receiving parcels
• Home meal deliveries
• Pool Maintenance
• Telecom related
services
• IoT installation and
repair
• Monitoring of fuel oil,
water (tank) levels
Air quality Glass Bubbles Efficiency
Energy efficiency
Water
Leakage
Home
Orchestra
…and much more
on mobility
Home Health
Management
Jumeaux
Digitaux
People
Car
Building
Drone
Smart Meters

Exemple de réalisation avec AWS
Grâce aux technologies IoT,
nous avons réalisé le jumeau
digital d’une maison
permettant à son
propriétaire, en collaboration
avec son assurance de faire
appel à des professionnel
pour toute réparation (fuites,
chauffage, …)
Jumeaux
Digitaux
People
Car
Building
Drone
Smart Meters

Amazon Relational
Database Service
(Amazon RDS)
Azure SQL
Amazon Aurora
Amazon DocumentDB
(with MongoDB
compatibility)
Amazon
DynamoDB
Amazon Neptune
Amazon Timestream
Azure
CosmosDB
Azure
Time
Series
Insights
Azure Synapse
Analytics
Serverless
Azure SQL
Database
Data in the Cloud – Cloud Data Platform
Relational
database
Serverless
Relational database
NoSQL
• Accélérer la
consolidation et
l'enrichissement
de l'information
• Profiter de
l’élasticité du
cloud
• Produit souvent
dédicacé au cas
d’utilisation
• Combinable avec
les bases de
données
standards On
Premise
• Utilisation du
ML/AI

Machine Learning

Utilisation des données par le ML/IA
Machine
Learning
Optimisation
énergétique
Détection de fraude
Analyse Pollution
Détection des
évènements
• Détection de l'imminence d'une rupture (panne) & Maintenance prédictive => Priorisation des
investissements
• Optimisation des temps de fonctionnement des pompes afin qu'elles ne consomment de l'énergie que
lorsqu'elles en ont besoin.
• Détection des rejets ou pollution.
• Détection de fraude – prise d’eau illicite (ex : bouche incendie si pas d’intervention pompier)
• Personnalisation de l’expérience client – Piscine / Maison vide,…
• Croisement des données externes (ex : météo) pour prise de décision
• Optimisation de la logistique
• Détection de l’arrosage illicite si contrainte sécheresse
Logistique

D
A
N
C
Data - Generation of important data volumes iot,
device, wearables, ...
Analytics - Ability to develop algorithmic, automation,
decision
Network - Ability to use multiple network technologies
with higher bandwith (Lora, Sigfox, NBIot, 4g, 5g)
Cloud - Availability of IT services (iaas, paas, saas)
without limits (automated, pay per use, self service)
Exponential Ressources, Innovation, empowerment -
combinatorial building blocks
© 2018 MIT. All rights reserved

https://nrbdigital.be
Merci

i
15 mars 2023
Digitalisation du Secteur de l’Eau –
compteurs communicants & réseau LoRa
Bernard Michaux, Directeur Production
1
Votre eau,
Notre essentiel

Territoire
—
24
Communes
2e
producteur-distributeur
public d'eau en Wallonie
2
50%
de la population
Province de Liège
561.830 habitants desservis
+
de

Production
—
Hesbaye
Néblon
DGP - SWDE
SWDE
Vivaqua
IDEN
Locaux
70%
d'autonomie de
production
3
275 km
de conduites de distribution
2 gros captages / 5 prises d’eau
souterraine

Distribution
—
3.429 km
de conduites de distribution
267.000 usagers
43,50 m³/an/habitant
4

Défis et contraintes
—
Sécurisation de l’eau,
cybercriminalité
Changements climatiques,
dégradation de l’environnement
Transformation digitale
Evolution des métiers
Prix de l’eau bloqué et non lié à
l’indice des prix à la
consommation
Contraintes européennes,
régionales et locales
Investissements/
infrastructures
Précarité sociale
croissante
5

Smart meters
—
6
Plan Stratégique CILE 2020 – 2022 & Economie Circulaire
• Augmentation du rendement des réseaux et protection de la ressource par une réduction des
fuites,
• Remplacement des compteurs vétustes,
• Amélioration de la satisfaction client.
D’où déploiement de compteurs communicants et mise en place de nouveaux services aux
usagers grâce aux informations ramenées via ces compteurs.

Principes d’un déploiement
—
7

Réseau privé LoRa
—
8
• 43 antennes.
• Le réseau doit être complété (relief accidenté).
• Utilisation des poteaux du GRD (RESA) et autres
bâtiments non CILE (convention en cours
d’élaboration).

Flux des données et protection
—
9

10

Flux des données et protection
—
11

Au niveau de l’exploitation
—
12
• Mise en corrélation des données usagers avec celles des compteurs réseaux,
d’où une meilleure connaissance des réseaux et de leur
(dys)fonctionnement (pertes).
• Alarmes en cas de retour d’eau.

Au niveau des usagers
—
13
• Facturation trimestrielle sur une consommation réelle.
• Nouveaux services : avertissement en cas de situation anormale sur
l’installation privée après compteur (fuites, température, retour d’eau -
responsabilités).
• RGPD.
• Pas de risques sur la santé.
• Mise à disposition du réseau LoRa.

i
Merci de votre attention
14

Cluster H20
Use case Brasserie Lefebvre - Technord

Nos bières Une entreprise 100 % familiale
depuis 1876
45 Salariés
CA : 10 750 000 €
70 000 hectolitres par an
Environ 80% à l’export

Technord, l’essentiel en une page
Un intégrateur global du génie électrique à l’informatique industrielle.
370
Employés
85 M€
De Chiffre d’affaires
12
Agences
80
Références à l’international
25% du CA à l’export
Marchés
Expertise
Pharmaceutique, biotech et
cosmétique
Chimie
Industrie Extractive
Industrie Verrière
Infrastructure et
Environnement
Agroalimentaire
Electricité industrielle
Automation & Process Control
MOM/MES – Industry 4.0
Digital Simulation & Process
Optimisation
Industrial IOT and Mobile Worker
Big Data & Analytics

Comment optimiser l’utilisation de l’eau dans la
brasserie?
Situation actuelle.

Les consommations actuellement.

Architecture actuelle des données.

Comment optimiser l’utilisation de l’eau dans la
brasserie?
Le projet.

L’emploi de l’eau de pluie.

Architecture mise en oeuvre

Impact de l’eau de pluie dans la production.
• Intégration de l’eau de pluie comme constituant de la nomenclature,
au même titre que l’énergie et les consommables.
• Gestion de la disponibilité dans le M.E.S.
• Implication dans la gestion de production.