WF SBP

Waterfall Secure Bypass

Remote access to industrial control systems is high risk: stolen passwords and two-factor devices introduce vulnerabilities to control systems. In addition, when a firewall is hacked, attackers gain direct access to critical systems, while third-party personnel threaten reliable operations when remote changes are made outside of a site’s change control procedures. The Waterfall Secure Bypass Module provides physical protection for emergency and other remote support mechanisms, and gives the industrial site physical control over enabling the frequency and duration of remote access.

WF SBP

Waterfall Secure Bypass

Remote access to industrial control systems is high risk: stolen passwords and two-factor devices introduce vulnerabilities to control systems. In addition, when a firewall is hacked, attackers gain direct access to critical systems, while third-party personnel threaten reliable operations when remote changes are made outside of a site’s change control procedures. The Waterfall Secure Bypass Module provides physical protection for emergency and other remote support mechanisms, and gives the industrial site physical control over enabling the frequency and duration of remote access.

FOR EMERGENCY ACCESS TO PROTECTED NETWORKS

FOR EMERGENCY ACCESS TO PROTECTED NETWORKS

Benefits

ERRORS & OMISSIONS REDUCED

Safe port mirroring from OT to IT, without introducing
internet-based cyber threats to monitored networks

PHYSICAL ONSITE CONTROL

Over the frequency and duration of remote access

pHYSICAL PROTECTION

From vulnerabilities inherent software-based
VPN and other remote access technologies

SECURE & DISCIPLINED REMOTE ACCESS

For protected sites where there are physical
consequences of cyber compromise

FEATURES

Hardware is modular, flexible, and user-serviceble

1Gbps standard throughput, multi-Gbps with several TX/RX pairs

Front panel cabinet connections for clear system visibility

ThEORY OF OPERATION

Waterfall’s Secure Bypass Module is deployed in parallel with Unidirectional Security Gateways. While the module is not engaged, the Gateways provide 100% protection from external online attacks. When activated, the Secure Bypass Module enables time-limited bi-directional connectivity to a unidirectionally-protected network for plant emergencies and scheduled changes as well as vendor, IT, internal support and other remote access needs.

When remote connectivity is enabled, the Secure Bypass Module electrically connects remote-access equipment to an external network. The SBP Module can be activated with a physical button or key, on a timer, or by a signal from the protected network. A timer in the Module automatically disconnects the remote-access equipment again after a preset interval. While the Secure Bypass Module is engaged, the Unidirectional Gateway continues to operate without interruption. 

CERTIFICATION & COMPLIANCE​

CERTIFICATION:

Common Criteria EAL 4+, ANSSI CSPN, NITES Singapore, Korean KC Certification and Israel NISA

ASSESSMENTS:

Idaho National Labs, Digital Bond Labs

INSTALLATIONS:

US DHS SCADA Security Test Bed, Japanese Control System Security Center Test Bed

ENABLES COMPLIANCE WITH:

Global ICS Standards & Regulations, NERC CIP, IEC 62443, NRC 5.71, NIST 800-82r2, CFATS, ISO, IIC SF, ANSSI, and many more

Resources

Request info/quote