Improve and integrate your OT security strategy

Using Network Sensors

Network sensors or IPS have, as their main purpose, threats detection in particular network points such as core switches. The defencing principle is quite straightforward, once a threat is active in the network sooner or later it will start to send traffic trying to discover and attack other targets, at this point network sensor or IPS can identify it reporting anomaly activities.

A security strategy based only on sensors has strength but also have some weaknesses.

It is devoted to threats detection and not prevention, once a threat tries to branch out it could be detected

Generally, a limited number of sensors are deployed in a portion of the network, and with a limited view on other devices, thus a lot of traffic is not analysed

Some malicious traffic can be mixed up with regular one

Less effective with encrypted or encapsulated data

Network sensors as well as any other detecting techniques are excellent tools to detect threats on OT network but once they are already walked in.

Advantages of integrating Edge SDN nodes

Edge SDN host isolation and traffic micro segmentation functions are the perfect complement of network sensors. Edge SDN node significantly reduce the network visibility of each asset decreasing accordingly the risk that a threat can be spread across the network.

Network sensors are therefore relegated to a simple analysis of allowed data exchange between known peers or to control stay traffic from unknown peers. This hugely increases the security of the network.

Network sensors strategy coupled with Edge SDN nodes enhance prevention capabilities to stop threats branching out and protecting assets and machines with a fine grain.

Using network border IPS or Firewall

A classic strategy of prevention and network defence is placing firewall or IPS at the border. Indeed, many different LANs with different purposes can be found both in IT and OT networks, this makes it necessary to protect the traffic crossing of different portions of the network.

However, this strategy has some limitations:

• It can only block or inspect packets crossing the border. Thus, having no control on internal network traffic, which means that it cannot have any security effect on those assets that exchange data without crossing the border. Security configurations between assets in the same network portions are unfeasible
• It can be difficult to plan and foresee security configuration rules for each asset in each network portion
• A wide range of unknown resources may connect periodically to the OT network, such as maintainers’ PCs, electricians’ equipment, and so on. In this case, heavily and time-consuming management activities could be required in order to properly protect those assets.

This results in a network strategy that can leave threats enough room to spread around.

Advantages of integrating Edge SDN nodes

Internal network can be segmented, controlled and completely automated thanks to the security features of Edge SDN platform. It is easy to create security profiles to confine data exchange between existing peers or assets that unpredictably can join the network and deep inspect packets for selected assets.

This gives a complete control to OT operators to make any asset, new or existing, safe and controlled.

Implementation of network segmentation with VLAN

It is a good security practice to segment network with different LANs or VLANs to separate data traffic. Usually, OT networks are segmented putting together similar assets with the same objective or risk level, trying to create LANs as much consistent as possible. However, using only network segregation can result in a weak security strategy, in fact to prevent threats escalation it is mandatory to check and control vulnerable assets within LANs.

• LAN and VLAN management can be a nightmare, especially if unknown resources or assets can periodically connect to the network
• There are significant security differences between tagged and untagged VLANs, without being aware you may have flaws or weakness around. Moreover, physical protection on switch ports may be necessary

Sometimes it can be difficult to create consistent local area network with similar assets, thus ending into heterogeneous assets inside the same network, without any knowledge about the real actual topology

Advantages of integrating Edge SDN nodes

Edge SDN node is a security Software Defined Network switch enhanced with an Intrusion Detection System based on a Self-learning AI algorithm. This is the key to control and inspect data traffic where threats can jump in. It is enough to use few SDN nodes in each local network as a local protection system where isolation, segmentation, prevention, and automation are fundamental bricks of the defence wall.

Network segmentation is consequently enhanced by a sophisticated security function to detect and prevent any threat or vulnerability.

Alone or coupled with other cyber security products, such as network sensors, assessment platforms or just traditional network segregation and firewalling techniques, Edge SDN Platform is an effective solution to protect the edge of the network.