Preem protects its infrastructure using solutions from Advenica

With a lot of digital data available in production systems, most companies want to export log data from these sensitive systems to be able to analyse the data. However by exposing your sensitive system, you make it vulnerable to cyberattacks; for example malicious code to enter your system. Preem, together with their AI process optimisation company Imubit uses data diodes from Advenica to make sure that the export of log data does not harm the production systems it is extracted from.

Challenge: Export log data in a secure way

Preem is Sweden’s largest fuel company and accounts for 80 percent of the Swedish refinery capacity and 30 percent of the Nordic refinery capacity. They also produce heating and lubricating oils, and supply many industries with heat and energy. Imubit is a vendor of an AI platform to Preem and Imubit receives performance data to their cloud solution through a data diode.

To be able to supply Preem with a better understanding of their business, with different digital analysis, Imubit wanted to export various log data from the Preem production systems to an Imubit application hosted in AWS cloud. Preem saw a risk with this and said no to a two-way connection since they didn’t want to expose their systems to the outside world. So how could they instead do this in a secure way – without jeopardising the sensitive systems and exposing it for potential cyberattacks?

Solution: Data diodes create secure unidirectional data flow

Imubit turned to Advenica – a Swedish cybersecurity company. They knew that Advenica could supply high-security data diodes and asked if it was possible to extract the desired data through a data diode.

To secure a unidirectional data flow between a production system and an IT system is a standard use case where a data diode is the best solution. With a data diode it can be guaranteed with assurance at the highest level that information can only pass one-way from the source network to the destination network. Another advantage is that you can keep the Purdue model intact but still extract the data.

Advenica data diodes meet the highest demands on both security and assurance

Internal separation of functions, multi-stage unidirectional security and deep security analysis provides trust and high assurance. Special attention has been given to eliminate the risk of covert channels in the reverse direction. Advenica data diodes DD1000A and DD1000i are approved by the Swedish Armed Forces with component assurance level N3, according to Swedish national security requirements. This makes them unique on the market and is highly beneficial during an audit. The difference between these two data diodes is the built-in proxies in the DD1000i, – which made it the preferred choice for Preem.

With the DD1000i it is now possible for Imubit to export data from the network to the AWS cloud via HTTP. Data diodes are easy to install and configure, and a simple standard use case can be deployed in a couple of hours. In this case Imubit could do this with their own staff with remote support from Advenica.

“We wanted to provide our supplier Imubit with log data from a network that is critical to us without compromising IT security. This allows them to monitor and ensure that their AI optimization model for the process plant functions as intended. By implementing a data diode from Advenica, we achieved this effectively,” says Anders Nilsson, Team Lead OT at Preem.

Outcome: Improved analysis by exporting sensitive data in a secure way

By placing a data diode between the production system and the IT-system it is ensured that the communication is strictly one-way and Imubit can now export the desired log data in a secure way. With the exported log data from the sensitive systems, it is now possible to work with improved analyses of the production systems at Preem. The data diode contributes to an environment that meets very high security requirements, and Imubit and Preem now feel secure that the data and the sensitive systems are protected at the highest level.