{"id":21498,"date":"2026-09-17T11:05:55","date_gmt":"2026-09-17T09:05:55","guid":{"rendered":"https:\/\/www.codewerk.de\/?post_type=ref_post_type&p=21498"},"modified":"2026-09-17T12:58:48","modified_gmt":"2026-09-17T10:58:48","slug":"penetration-test-wassergewinnung-essen","status":"publish","type":"ref_post_type","link":"https:\/\/www.codewerk.de\/en\/referenz\/penetration-test-wassergewinnung-essen\/","title":{"rendered":"Penetration test of a process control system at Wassergewinnung Essen"},"content":{"rendered":"
\n
\n

Reference · Cyber Security<\/p>\n

Penetration test of a process control system at Wassergewinnung Essen<\/h1>\n

Security is decided in operation, not in a document.<\/p>\n<\/p><\/div>\n<\/section>\n

\n \"Water
\n \"Water
\n<\/section>\n
\n
\n

The requirement<\/h2>\n

Wassergewinnung Essen GmbH supplies drinking water and is therefore part of the critical infrastructure. The German IT Security Act 2.0 and NIS-2 define what has to be demonstrated. Concepts, audits and certificates were all in place.<\/p>\n

What remained open was the question no document answers: do the measures hold when someone attacks them in earnest? An attacker does not follow the security concept. They use whatever works.<\/p>\n

WGE therefore did not want another theoretical analysis, but a practical validation of its process control technology. And it wanted day-to-day operations to stay as simple as possible.<\/p>\n<\/p><\/div>\n<\/section>\n

\n
\n

Why operational technology has to be tested differently<\/h2>\n

IT penetration tests are standard. There are established methods, tools and plenty of providers. In operational technology the situation is different.<\/p>\n