Blog

Critical infrastructure cybersecurity has never been more important or challenging. These organizations have become prime targets for cybercriminals and hostile state actors. At the same time, digital transformation is expanding the attack surface with new devices and external connectivity.

While most critical infrastructure facilities have invested in some cybersecurity defenses, many lack the resources needed to maintain security hygiene and deal with security alerts. Poor visibility of vulnerabilities and threats compounds the problem. Lack of good asset information hinders efforts to manage the constant flow of new security alerts and patches. Unfiltered alerts and lack of good contextual information complicate efforts to investigate and respond to potential threats.

This leaves many facilities at high risk of serious cyber incidents affecting security and operational continuity. No organization can afford to operate under these conditions. Addressing OT and IoT cybersecurity security program gaps should be a top priority for every critical infrastructure deployment.

OT Cybersecurity Under Attack

The risks of cybersecurity breaches at critical infrastructure facilities have increased significantly in recent years. Manufacturers, healthcare organizations and other critical infrastructure operators around the world are facing more challenging threat environments. At the same time, changes companies are making to their operations are opening up new avenues of attack to compromise critical operations.

In the past, critical infrastructure operators focused primarily on blocking generic malware circulating on the internet. Today, security teams must defend facilities against targeted attacks from sophisticated adversaries and compromised software downloads from vendors. Findings from a recent research report showed that one-third of all ransomware attacks are launched against industrial companies. Political unrest has also increased cyber warfare attacks on critical infrastructure.

Digital transformation is happening at a rapid pace in the critical infrastructure environment. Operators, inspectors and maintenance staff are using mobile devices, augmented reality (AR) and digital twins to increase efficiency and effectiveness. Robots and autonomous vehicles are being used to drive higher productivity and process consistency. Managers are investing in a plethora of new IoT sensors and cloud analytics to help them optimize workflows, improve product quality and reduce safety incidents. Facilities are making greater use of remote access for vendors and teleworkers to get the fast, 24/7 support they need to minimize operational disruptions.

All these digital transformation developments increase the risk of serious cyber incidents that can jeopardize security and business continuity. Every new connection to external systems and devices creates a potential avenue for remote attacks. Every new IoT device creates a potential launch pad for insider attacks. Mobile devices create new opportunities for confidential information to leak out and malware to insert into critical workflows. Limited security teams cannot keep pace with these growing risks without solutions that provide the information they need to focus their efforts on the most critical vulnerabilities and threats.

Broad Visibility is Essential for Survival

Visibility is vital to the effective management of cybersecurity risks, and this includes visibility of all threats and vulnerabilities. Threat visibility needs to cover potential attacks originating from systems, devices and networks around the facility, as well as external threats targeting facilities in the same region or industry. Vulnerability visibility needs to cover all weaknesses in all system devices and all vulnerabilities that may exist in systems or devices that provide access to the processes that control the systems. In both cases, any changes in threats and vulnerabilities need to be reported immediately so that security teams can prioritize their efforts and adjust their defenses.

In the past, critical infrastructure environments and systems were stable. So companies could reasonably assume that annual security assessments and general vulnerability alerts were sufficient visibility to manage security risks. But in today’s dynamic world, visibility needs real-time threat intelligence and continuous monitoring of systems to detect new devices, connections and vulnerabilities.

Some facilities have already invested in passive visibility solutions to help them automate asset inventories, identify devices with known vulnerabilities and detect anomalies in internal network communications. But concerns about lack of resources and operational disruptions have limited more widespread implementation of these critical capabilities. Overcoming these obstacles is crucial to defending systems against today’s attacks.

While good, passive scanning solutions are still not enough for today’s challenging environment. Risks on devices that are off-network or rarely communicate across firewall boundaries can go unnoticed until it’s too late to stop system-wide attacks. Security teams can also be overwhelmed with alerts that lack sufficient filtering and context to facilitate rapid forensics and response. In today’s world, companies need solutions that address these issues and extend visibility to all threats and assets.

Nozomi Networks Fulfills Modern Visibility Needs

Nozomi Networks is a leading provider of critical infrastructure visibility products used by companies around the world to minimize cyber risks and maximize operational resilience. Guardian and Vantage solutions provide real-time asset visibility, threat detection and actionable intelligence for critical infrastructure. Nozomi Networks solutions are used to support installations in energy, manufacturing, mining, healthcare, transportation, utilities, building automation, smart cities and across critical infrastructure.

Since its founding in 2013 as a passive network scanning solution, Nozomi Networks has continued to develop and expand its portfolio of solutions to tackle growing cybersecurity challenges.

Nozomi Arc is the latest addition to the Nozomi Networks solution portfolio. This product transforms existing endpoint devices into visibility sensors that provide critical information about endpoint threats. It also extends Guardian’s asset inventory and network anomaly detection capabilities to more assets and isolated systems by enabling local intelligent polling and remote collector capabilities on local networks.

Nozomi Arc provides detailed information about operations occurring on endpoint devices that cannot be detected in network traffic. This includes information about users and erroneous system events that can only be detected by analyzing events reported in device log files. The product also monitors USB communications to detect threats from malicious devices masquerading as keyboards.

Nozomi Arc extends the use of Guardian visibility capabilities to assets in hard-to-reach network segments. This includes intelligent polling of local devices to obtain asset information and monitoring of local, East-West traffic to detect suspicious messages and patterns.

Security-related information collected by Nozomi Arc is sent to Guardian or Vantage for further analysis. This information is then used to alert users to endpoint threats, filter system alerts, and provide additional context to accelerate defender forensics.

Because Nozomi Arc communications are secure outbound connections, it does not require changes to existing firewalls that could open remote systems to external attacks. This is a key advantage of Nozomi’s approach as it overcomes a common user concern that prevents the use of intelligent polling to extend visibility into remote systems and devices.

Nozomi Arc provides all these functions without overloading endpoint device operations or disrupting mission-critical networks. The Nozomi Arc endpoint sensor is deployed as an executable file in the background and can be automatically removed after collecting information to conserve host resources. This allows user policies to manage how often the Arc sensor is installed and collects.

Nozomi Arc is designed for rapid and remote deployment. This enables companies to deploy product quickly and reap the benefits of improved operational flexibility across all sites and devices, regardless of geographic, operational or resource constraints.

Conclusion
Threats to critical infrastructure have outpaced the capabilities of existing cybersecurity programs. Most facilities lack the security resources, technologies and cybersecurity management tools to defend operations against ransomware and advanced attackers. They also lack the people and expertise to ensure the security of new digital transformation efforts and the expanded use of remote workers. The risks to security and operational resilience are too great for any company to ignore the growing risks of serious cyber incidents.