Poland's critical infrastructure braces for digital warfare amid hybrid threats

Companies managing critical infrastructure in Poland, such as the Veolia Polska Group, are confronting the stark reality of cybersecurity in the context of modern hybrid warfare. A successful cyberattack on their operational systems could immediately cut off essential services like heat and power to thousands of homes, underscoring the direct and severe societal consequences.

The ongoing conflict east of Poland has highlighted that energy, water, and heating sectors are on the front lines of these evolving hybrid conflicts. Strategic companies are no longer questioning if they will be targeted, but when. This proactive stance involves robust preparation and a clear understanding of the threats.

“

Jestem optymistą, ponieważ te regulacje to nie są przepisy wymyślone na nowo. Od 2018 r. funkcjonuje już w Polsce pewna kultura cyberbezpieczeństwa. Przepisy pojawiają się po to, aby dostosować kraj, przedsiębiorców czy administrację publiczną do nowych zagrożeń. Mając dobrze ugruntowany fundament z lat wcześniejszych, tylko rozszerzamy pewne zakresy.

Piotr Potejko, Veolia Polska's Chief Security Officer, expressed optimism regarding Poland's and its companies' cybersecurity efforts, despite the concerning rise in threats and organized criminal groups. He noted that regulations, including the amended National Cybersecurity System (KSC) law implementing the EU's NIS 2 directive, have been effective motivators. Potejko emphasized that these regulations build upon an existing cybersecurity culture in Poland since 2018, expanding existing frameworks to address new dangers.

However, Potejko cautioned against over-reliance on high financial penalties, drawing parallels with GDPR where massive fines were stipulated but rarely enforced. He argued that such "scare tactics" are not always effective. Instead, he advocates for building awareness, fostering dialogue, and pursuing continuous improvement in cybersecurity practices. The market faces challenges like staff turnover in the IT sector and budget constraints, but the focus remains on proactive defense and adaptation.

“

Ale spójrzmy na RODO, gdzie również zapisano ogromne kary. Trudno wskazać sfinalizowane sprawy w sądach, w których rzeczywiście je nałożono, co pokazuje, że te straszaki niekoniecznie są efektywne. Zamiast tego wolę budować świadomość, rozmawiać, naprawiać i stale dążyć do perfekcji w zakresie cyberbezpieczeństwa.