The Future of ICS Security Products
•Download as PPTX, PDF•
1 like•1,743 views
The document discusses trends in industrial control system (ICS) security products. It notes the importance of asset inventory for detection and outlines different tiers of ICS detection vendors. Top tier vendors are growing rapidly through investments in R&D and acquisitions. They are distinguished by their large employee size, product maturity, and repeated selection in customer bake-offs and pilots. The document advocates starting with asset management, then adding detection integrated with asset data, and configuring incident response through a retained services model.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to The Future of ICS Security Products
Similar to The Future of ICS Security Products (20)
More from Digital Bond
More from Digital Bond (20)
Recently uploaded
Recently uploaded (20)
The Future of ICS Security Products
- 1. The Future of ICS Security Products
- 2. 2
- 4. 4
- 5. 5
- 6. 6
- 7. Asset Inventory To The Rescue ◦ Didn’t have an asset inventory ◦ Outdated spreadsheet at best ◦ Amazed at what passive monitoring could tell them ◦ Easy win for customers and vendors 7
- 8. 8
- 9. More accurate and more detailed information on your cyber assets. Using only legitimate protocol requests. NOT SCANNING! 9
- 10. 10
- 11. More accurate and more detailed information on your cyber assets. Using only legitimate protocol requests. NOT SCANNING! 11
- 12. If you can’t stomach Active then use your EWS or other ICS component to query cyber assets so Passive can see the answers. 12
- 13. Asset Management ◦ Asset Inventory ◦ Configuration Mgmt ◦ Vulnerability Mgmt ◦ Change Management ◦ … 13
- 14. 14
- 15. 15
- 16. 16 ICS Detection Asset Mgmt Vuln Mgmt SIEM / SOC
- 17. 17
- 18. Vulnerability Management ◦ Requires software inventory ◦ Identify vulnerable sw / fw ◦ What to patch? When? What application will apply the patch? 18
- 19. Detection
- 20. Prioritized List of Detection Sources - Endpoint protection alerts - Blocked firewall egress attempts - New admin users - … 20
- 21. 21
- 22. Same - Switch span port or tap, passive traffic collection - Lots of signatures - Same data overwhelm issues Network IDS with ICS Protocol Smarts Different - Able to parse ICS protocols - Alert on legit, high risk cmds - Some anomaly detection - ICS Playbooks 22
- 23. 23
- 24. Incident Response ◦ What good is detecting if you can’t respond? ◦ Detection products provide data for after incident investigation ◦ Knowing ICS and the product is key for effective response 25
- 25. 26
- 26. What Will You Do With The Data? ENTERPRISE SOC Forward the ICS detection system data to Enterprise SOC. Add ICS talent to the SOC and response team. STAND ALONE SYSTEM Analysts use product as primary ICS detection system. OT SOC ICS detection system used as one detection source in an OT SOC. 27
- 27. 28
- 28. 29
- 29. Lots of Change ◦ Asset Inventory will not be part of detection product ◦ ICS Detection GUI won’t matter ◦ Integration with SOC systems ◦ Sensors will be in your switches ◦ Competitors will almost all change 30
- 30. Slow Down / Pilot Position As Interim / Learning 31
- 31. What Would I Do? (in order) ◦ Start with an asset management solution ◦ Get detection solution ◦ Integrates with asset mgmt ◦ Retains forensics records ◦ Get incident response retainer ◦ Focus on SOC integration 32
- 32. Asset Inventory / Management - PAS - Langner OT-BASE - Asset Guardian - MDT Software - DCS vendors 33
- 33. 34
- 34. What Is Top Tier? BAKE OFFS & PILOTS We saw the same four repeatedly in asset owner competition and pilots. COMPANY GROWTH Top Tier now are 100+ employees and growing. Accelerating & leaving the rest behind. RAPID PRODUCT DEV Huge investment in R&D showing in new features and product maturity. 35
- 35. Detection Tiers (US) July 18 Claroty / Dragos / Nozomi / SecurityMatters 36 CyberX / Indegy / Kaspersky / Sentryo The Rest https://dale-peterson.com/ics-detection-market-analysis/
- 36. Detection Tiers (US) Nov ‘19 Claroty / Dragos / Nozomi 37 CyberX / Indegy / Kaspersky / Sentryo* / Radiflow 11 Competitors https://dale-peterson.com/ics-detection-market-analysis/
- 37. Acquisitions Forescout buys SecurityMatters ($113M) 38 Cisco buys Sentryo (my guess ~$50M) Tenable buys Indegy ($78M) Also GE, Honeywell, Kaspersky …
- 38. Detection Tiers (US) Today Claroty / Dragos / Nozomi 39 CyberX (Microsoft?) / Radiflow SCADAfence + 5 Others https://dale-peterson.com/ics-detection-market-analysis/
- 39. Thanks! Any Questions? Dale Peterson, CEO of Digital Bond peterson@digitalbond.com https://dale-peterson.com Founder of S4, every Jan in Miami SoBe https://s4xevents.com Twitter: @digitalbond Unsolicited Response Podcast YouTube: www.youtube.com/s4events 40
Editor's Notes
- Like most things OT, Ops said it was impossible. Ethernet, Windows, anti-virus, application whitelisting, virtualization, we were even told passive IDS would break ICS in 2006. So predicting years ago that active would be used was easy.
- What cards are in the PLC, what firmware, when was the logic last updated
- Physical location, criticality, who is in charge You really need asset management which includes other items
- Will some pivot to this
- Move away from spreadsheets, manual asset inventory. Automate Drawing showing Vuln Mgmt, Passive Detection, Asset Management, SOC, all talking through Rest API
- Increasingly popular feature in this new class of ICS detection products … but they don’t apply the patches so you need another vulnerability management solution. Decision tree – exposure, criticality, safety, CVSS, and exploit in the wild (Never, next, now)
- Rebekah Mohr, Ben Goerz Kimberly Clark tomorrow on the S4 Events YouTube Channel
- Cisco’s acquisition of Sentryo and their Cyber Vision products is just the start.
- Said this 18 months ago and still true. At least position that you could rip and replace this detection solution. Perhaps subscribe rather than buy, although a lot of times the break even is between 2 and 3 years.