Operational Technology Market Overview

From industrial to military necessity

Due to the increase in technology deployment in industrial platforms moving toward industry 4.0, the threat level of cyber-attacks raised due to the gravity of such at- tacks not only economically but possibly causing life casualties. This raise in technology deployment in the industrial field caused the cyber-criminals to focus their attacks on the used operation technologies OT as a new platform of attacks and gain.

Also due to the increase of automation and robotization of both the workplace and the production chain, these dependencies are only expected to grow. It is for this very reason, that both attacks and attackers have grown their complexity exponentially these past years. And this trend is only expected to grow. Even at a geopolitical level we are starting to see military interest in these types of attacks as a new weapon.

It’s for this reason that new security solutions are starting to appear in the market. By consolidating security solutions and providers the industry is looking to facilitate cross-environment integration. Organizations should strive to combine their OT and IT solutions and to consolidate around a smaller number of providers to reduce complexity and obtain a centralized view of all devices—both IT and OT. Organizations can reduce their risk and improve their security and operational efficiency by using integrated security solutions.

What are the important points related to OT

Near-edge security

In an OT environment there are thousands of IoT devices that communicate with each other and that are vulnerable to attack. Bringing security as close as possible to such devices is critical to prevent threat expansion.

Integration and adaptability

OT environments are resistant to change, and for good reasons. Any security solution that might be implemented needs to be as adaptable and require as little changes as possible. Cloud is viable, but usually on-site approaches are preferred.

Understanding Operational Technology security

Network segmentation is also becoming fader every day. IT and OT networks are more inter-connected than ever, and this brings a whole new set of problems into the picture. Any centralized security solution must be able to handle both IT and OT threats to properly cover all scenarios that might affect this new architecture.

be.OT has been build from the ground up with these difficulties into consideration. Exploiting Teldat´s advanced networking capabilities and with our new security solutions in place, we are able to provide full visibility to our users though our state of the art NTA while providing a centralized, unified security solution that handles both OT and IT threats within a single system, providing our users a simplified, centralized screen in which all security and visibility issues can be addressed.

OT Case Studies

OT asset and device management with customized reporting and alert generation.

Detection of suspicious activity and traffic on an OT networks

Challenge

Attackers can cause security breaches by infecting devices to spread malware over the network or act as bots to massively attack the organization itself or other companies. They can also steal credentials or gain unauthorized access to enter the network and try to get as much information as possible from the inside. This is what’s known as a lateral movement attack.

Solution

Traffic visualization and log analysis platforms make it possible to monitor everything that is going on in the network without generating a greater load on equipment or causing delays in communications. By having information on how the network usually behaves, traffic patterns are generated that allow anomalous behavior to be detected, such as multiple IPs accessing the same destination for a denial-of-service attack or attempts to access networks that are not allowed for a specific device.

In this way, automatic responses can be generated, disabling those suspicious devices suspected of having been infected or revoking access or credentials if they are detected attempting to access sensitive information when they shouldn’t, thus preventing them from achieving their goal.

Why Teldat?

Teldat’s be.OT solution analyzes all network behavior, applies Machine Learning and Artificial Intelligence techniques to detect suspicious behavior and detects and blocks any attack using specific signatures for OT environments.

Control of access Internet for OT devices and users

Challenge

With the large increase in the number of devices in OT networks, information management is becoming increasingly complex as private networks are not always available making it necessary to provide access to public clouds for storage or log management and processing. On the other hand, employees may need access from external networks, with controlled access permissions to ensure no one gains control of the entire network from outside. An external DDoS attack or access attempt using outdated credentials can pose a serious security threat.

Solution

All traffic leaving the network can be controlled by means of security platforms, not only checking ports or IP addresses, or even hosts, but also using specific OT protocol signatures that allow access only to traffic that must be sent to the outside.

Similarly, secure access can be provided to the internal network through VPN connections to remote users, controlling access privileges to allow, for example, only SSH access to devices for monitoring or only allow reception of certain specific protocols to avoid information leaks.

Why Teldat?

Teldat’s be.OT solution supports more than 1000 application controls and IPS signatures for ICS OT. The intelligence provided through the industrial security solutions comes from the Teldat lab development team, which has been providing intelligence for corporate security applications for more than 30 years with the best security effectiveness and recognition in the industry.

OT networks and device monitoring

Challenge

OT networks can be made up of thousands or tens of thousands of devices sending traffic to various sources and with multiple hierarchical levels that complicate the management of access, inventory and network usage by the devices. Availability requirements are also critical, unlike in IT environments where delays may be permissible, so any alerts must be reported and corrected in the shortest possible time.

Solution

OT network management platforms should allow auditing of network behavior, detecting inappropriate behavior and assigning suitable thresholds for alerts that can be sent via email. Identifying the most active devices is very useful to optimize the deployed infrastructure and avoid potential bottlenecks that could slow down processes.

Simple management requires graphical visibility of connected devices to enable optimization and validation of connections. All this must be accompanied by the generation of periodic reports that group and synthesize information for quick and easy analysis.

Why Teldat?

Teldat’s be.OT solution parameterizes alarms to avoid false positives, generates network usage reports, allows visibility of both application and source/destination traffic, and provides detailed analysis of traffic patterns and usage trends.