Closing security
gaps – Kaspersky
delivers industrial
cybersecurity
assessment forPlzeňský Prazdroj

Plzeňský Prazdroj

https://www.prazdroj.cz/en/Plzeňský Prazdroj a.s. is a Czech brewery foundedin 1842 and headquartered in Plzeň, Czech Republic.
Brewery• Founded in 1842
• Plzeň, Czech Republic• >2,000 employees in 3 breweries
and 13 distribution centers• 8 packaging lines in Pilsen plantPlzeňský Prazdroj is the first brewery to produce the pilsener blondlager style beer, branded Pilsner Urquell, making it the inspiration for
more than two-thirds of the beer produced in the world today, which
are named pils, pilsner and pilsener. Both Plzeňský Prazdroj and Pilsner
Urquell can be roughly translated into English as “the Fountainhead atPilsen” or “the original source of Pilsner”.
Plzensky Prazdroj is the leading brewing company in Central Europe.
Through its brands, Plzensky Prazdroj sells more beer in the Czech
market than any other company. From 1999, the brewery was partof the SABMiller group of companies (at the time, South AfricanBreweries). As part of the agreements made with regulators,
before Anheuser-Busch InBev was allowed to acquire SABMiller inOctober 2016, Pilsner Urquell – excluding certain geographical areas, –was sold to Asahi Breweries of Japan on March 31, 2017.

Challenge“ Our strong need
was to be ready for
any unexpected
incidents, examine
our OT infrastructureand establish
a deployment plan tosecure the industrial
network by the world’sleading professionals.”Jan Šik, chief engineer,Plzeňský Prazdroj

As a large manufacturing company, Plzeňský Prazdroj treats thecybersecurity of IT and OT very seriously. In recent years, someindependent audits have been carried out at the company, with someinteresting findings. As soon as the technology development onPlzeňský Prazdroj is a continuous process, the necessity for a new
independent assessment emerged.
At the time, the technology background was changing from separate
systems running on standard PCs to a virtualized server-based mastersystem that connected all systems and devices.
Primary motivation for the company to do a cybersecurity assessment(CSA) was to check the infrastructure at the final stage of the projectthat included virtualization of the production systems and upgrade of
the main OT networking components. Secondary factor was to prepare
main topics and requirements for the future project focusing endpoint
security solution and make sure that all production plants of PlzeňskýPrazdroj company would not be affected in case of a targeted cyberattack or falling “victim” of attack on other closely related companies.
The goal of the industrial CSA project was to make sure the productionlines and all OT related software and hardware were resistant to cyberattacks, and that the company was ready to implement a holistic
industrial cybersecurity strategy.
The most challenging aspects for industrial cybersecurity policies
before the CSA were the complexity of the OT infrastructure(two segments – brewing and bottling with completely differentinfrastructure), its connections with external business systems and therecent launch of a new production line.

2The Kaspersky solution
Non-intrusive solution

Kaspersky Industrial CyberSecurity
Assessment does not affect the operational
continuity or consistency of the industrial
processes.

Deep expertise

Real-live experience with a wide range ofindustries and OT equipment allows
Kaspersky experts effectively provide
industrial cybersecurity services.

Holistic approach

Kaspersky Industrial CyberSecurity is aportfolio of technologies and services, thatbring value on any stage of the customer’s
OT security process – from training andassessment to incident response.

“Plzeňský Prazdroj chose Kaspersky’s industrial CSA, which provides
a minimally invasive remote and on-premise cybersecurity assessment.
Kaspersky experts started the industrial CSA process with an
infrastructure audit and threat model development. Plzeňský Prazdroj
industrial processes are mainly divided on brewing part and bottlinglines, including in total 2 brewhouses and CCT areas and 8 packaginglines in Pilsen plant. Kaspersky experts examined the infrastructure’s
most critical segments emulating specific attack vectors, discovering
vulnerabilities and scanning for malicious activity and anomalies.
Starting their assessment from the corporate network linked toindustrial zone, Kaspersky experts noticed some externally developed
business software containing dangerous vulnerabilities that can help toaccess some of the OT devices through another IT system really simply.
In the industrial segment of brewing part, Kaspersky experts discovereda zero-day vulnerability of SCADA software.
Other activity was conducted at this stage to discover and describe all
uncontrolled external connections from/to industrial floor.
At the end of this stage Kaspersky experts provided Plzeňský Prazdroj
a full list of discovered vulnerabilities and security gaps, including weakauthentication, SQL injections, etc. along with a detailed analysis of
how they could be exploited. In addition, Plzeňský Prazdroj received adescription of detected and confirmed attack vectors that could damage
the continuity or integrity of the company’s industrial processes.

3

“ The decision tocooperate withKaspersky was aneasy one for a numberof reasons. Theirexperience in the ICS
cybersecurity domain,
professionalism andthe complexity of theirsolution, in comparison
with other suppliers,
has given us greatvalue and ensured
a bright future for ourcompany’s security
strategy.”Ondřej Sýkora,
C&A manager,Plzeňský Prazdroj

Based on research data from the first stages, Kaspersky experts developeda threat model used as a basis for developing actionable recommendations.
This final report is essential for a customer, as it includes recommendations
for subsequent cybersecurity measures for specific industrial components
and mitigation techniques for vulnerabilities. Recommendations for PlzeňskýPrazdroj included ensuring update and password policy as well as hardening
network and web application security.
“The analysis showed us significant recommendations for the security
lifecycle and highlighted weaknesses in security processes. Several
areas for improvements were noted and all findings were summarized in
the final report”, says Miroslav Zajíc, IT analyst at Plzeňský Prazdroj.

PerspectivePlzeňský Prazdroj affirms that Kaspersky experts professionally organizedand executed the industrial CSA and provided the basis for ensuring astrategic approach to industrial cybersecurity within the company.
“With Kaspersky we are planning to follow up on the CSA results
and recommendation and continuing discussing the deployment ofKaspersky Industrial CyberSecurity solutions for nodes and servers”,
says Ondřej Sýkora, C&A manager at Plzeňský Prazdroj.

Kaspersky Industrial CyberSecurity is a portfolio of technologies and services designed tosecure operational technology layers and elements of your organization - including SCADA
servers, HMIs, engineering workstations, PLCs, network connections and even engineers without impacting on operational continuity and the consistency of industrial process.
Learn more at www.kaspersky.com/ics

Kaspersky ICS CERT:
https://ics-cert.kaspersky.com
Cyber Threats News:www.securelist.com***#Kaspersky#BringontheFuturewww.kaspersky.com
2019 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are theproperty of their respective owners.

* World Leading Internet Scientific and Technological Achievement Award at the 3rd World InternetConference** C hina International Industry Fair (CIIF) 2016 special prize