Active Defense in OT – How to Make it Work | Episode 110

Please note that there isn’t a transcript for this episode. Here are some of the highlights from this week’s podcast:

In this episode we look at how network Intrusion Detection Prevention Systems (IPS) can work in OT / industrial environments. An IPS is an IDS with extra functionality. A network IDS looks at each packet in the network or network connection and decides if the packet or stream of packets looks suspicious. If the IDS recognizes what looks like an attack in progress, the IDS an alert – usually to a SEIM to log the event.

An Intrusion Prevention System (IPS) does same thing – and if the attack seems serious enough, the IPS will take actions to interrupt the attack in progress. For example, some IPS systems that watch copies of network traffic on mirror ports will send TCP Reset (RST) packets back into the mirror port, targeting the TCP connection that is being used to propagate the attack. These packets cause the TCP connection to close, interrupting the flow of attack information.

While this seems fairly straightforward for IT networks, the risk of false alarm is a problem historically on OT networks. A false alarm risks shutting down essential communications and causing entire plants into costly unplanned shut-downs as a result.

Youssef Jad digs into the CyVault Dome product that addresses this issue to bring about active defense – IPS – on industrial networks. How can this be done safely? CyVault has tested attack interruption actions with industrial vendors and industrial equipment. The Dome product interrupts attacks in progress only when an engineering study has proven that such interruptions are safe – that they pose no threat to industrial operations. And the system can use old-school TCP RST packets, or more modern methods of interrupting attacks, involving interactions with the hosts and endpoints involved in the attack connections.

And if attacks are ever detected on systems or connections where outright interruption has not been proven safe, the IDS component of the solution still raises high-priority alerts. In this case, CyVault also works closely with engineering teams at the site to walk them through the investigative and restorative procedures involved in diagnosing what’s going on and fixing it.

Again – common wisdom is that you simply cannot do IPS deep into industrial networks. CyVault proves this common wisdom is outdated.

Listen in to get the full scoop.