As Finland’s largest electricity distribution company, Caruna Oy forms part of the country’s critical infrastructure. As the operating environment becomes increasingly digitalised, regulation tightens and the global security situation continues to evolve, the importance of cybersecurity is only growing. At Caruna, cybersecurity has been developed systematically and over the long term together with Insta. Over the years, the role of a trusted partner has become essential.
Cybersecurity Protects the Core of Operations
Kimmo Juntunen, Cybersecurity Manager at Caruna, describes the company’s cybersecurity architecture using the onion model.
"The crown jewel - electricity distribution - lies at the core, and protecting it is our highest priority. Around it are several layers, all of which must also be covered by cybersecurity."
Juntunen has witnessed the transformation of cybersecurity over the past ten years. This change has been driven by factors such as increasing EU regulation, the rise of remote work, the geopolitical situation and technological development. Artificial intelligence, among other things, has further increased the importance of cybersecurity.
"The attack surface is not growing linearly, but exponentially. Where operations may previously have been more reactive, the focus today is on preparedness and resilience. In this work, Insta is one of Caruna’s most important partners", says Juntunen.
Leading the Way in Cybersecurity
The energy sector is heavily regulated, and the requirements related to cybersecurity have become more stringent. For example, the NIS2 cybersecurity legislation has introduced new obligations.
Caruna aims to be a frontrunner and invests heavily in cybersecurity. Its internal cybersecurity team consists of experts from different specialist areas, complemented by Insta’s team of more than 170 professionals.
"As Finland’s largest electricity distribution company, Caruna is often seen as a benchmark. Increased regulation means more work, but it also gives us the opportunity to lead the way in raising the overall level of cybersecurity across society," Juntunen explains.
According to Caruna CIO Timo Tolska, cybersecurity is developed systematically as part of the company’s strategy.
"In ICT, we engage in long-term planning and identify key focus areas that we advance as part of our annual business plan. Cybersecurity priorities are an integral part of this overall framework."
The Partnership with Insta Covers a Broad Range of Cybersecurity Domains
The collaboration between Caruna and Insta spans several areas of cybersecurity, including continuous security testing, penetration testing, preparedness exercises, situational awareness and vulnerability management.
In day-to-day operations, the partnership is reflected in regular situational awareness meetings, prioritisation, service management and crisis simulations.
"In terms of substance expertise, Insta’s people are undoubtedly among the very best in Finland, and their attitude is also highly service-oriented. Their uncompromising approach is evident, for example, in the fact that if help is requested after business hours, they answer the call and make sure issues are not left unresolved," Juntunen says.
According to Tolska, continuity is one of the cornerstones of the partnership.
"One of the foundations of this collaboration is that the same experts have been working with us for a long time. Insta specialists who know our environment well are highly valued at Caruna."
Caruna specifically looks for genuine partners in its network.
"If we have a problem, we want our partners to feel a sense of ownership and truly operate as part of our team. Insta and Caruna experts work and communicate seamlessly together."
Choosing a Partner Is a Strategic Security Decision
For Caruna, it is important that a partner understands the critical infrastructure environment and is able to demonstrate the quality of its operations. Insta’s operations are widely certified in accordance with some of the industry’s most demanding standards. This facilitates collaboration and strengthens trust.
"For us, selecting a partner is a strategic security decision. Cybersecurity is built on trust, and it is much easier to get started when we do not need to ask the same 200 questions that an auditor has already asked", Juntunen says.
Tolska closes with an important message to the Finnish business community as a whole:
"Strengthening your own defences alone is not enough. What is also needed is collaboration and the sharing of situational awareness. We actively participate in peer networks and also gain valuable sparring from the international level. No one succeed´s alone. "
Get in touch by email
security (at) insta.fi
