In any technology environment, practicing basic cybersecurity hygiene goes a long way toward resilience. Many basic cybersecurity practices carry over from IT to OT, with greater emphasis in areas such as segmentation and continuous monitoring to compensate for infrequent patching opportunities. Best practices include:

• Strong password policies to prevent unauthorized access
• Least-privilege access policies that restrict access to critical systems to only those who need it
• Visibility into what’s happening on the network through automated asset inventory and continuous monitoring to detect changes that could increase cyber or operational risk
• Risk-based vulnerability management prioritization based on correlated events
• Strong network segmentation to isolate threats and protect critical assets and process
• Secure remote access with strong authentication, least-privilege rights, and monitoring and logging of remote sessions, including third-party vendors
• OT-specific incident response plans designed to limit impact while maintaining system recovery and reliability

 Purpose-built for industrial networks, the Nozomi Networks platform excels at providing visibility through automated asset inventory and continuous monitoring.

可視化

Visibility into what’s happening in your network is a cornerstone of cybersecurity; you can’t manage what you can’t see. What assets are connected to your network? To the internet? What’s talking to what, using which protocols? Who’s logging in, to what, from where? Is there any unauthorized traffic? Are your controls and policies working as designed? None of these questions can be answered without visibility, which involves

• Discovering all assets in real time as they connect to your network
• Maintaining an accurate inventory of all connected assets
• Continuously monitoring the network to detect both threats

In industrial environments, network visibility is not only essential for cybersecurity but also for troubleshooting operational anomalies and other issues. For example, detecting anomalies in data traffic might not just signal a potential cyber intrusion but could also indicate a malfunctioning piece of equipment that needs immediate attention.

The Nozomi Networks platform uses a variety of data collection methods, including network monitoring, endpoint monitoring, wireless monitoring and smart polling, to provide continuous visibility into all your assets and their risk levels, even when they aren’t actively communicating.

As soon as installation is complete, the platform starts analyzing the ICS network traffic and builds an interactive visualization that shows a macro view of the entire network as well as each individual asset and node, with the ability to drill down to any endpoint or connection to see detailed attribute.You also see:

• The network topology showing zones, protocols and VLANs
• ゲートウェイの背後にあるシリアルデバイスなど、ネストされたデバイス
• A view of geographically distributed industrial sites
• Filtered views by Purdue level, device type, role, subnet, zonesand conduits, etc.

‍

‍

Automated Asset Inventory

Automated asset management provides foundational visibility into what’s connected to the network, their key attributes and, ideally, additional context for operational troubleshooting and threat investigation. An automated asset inventory eliminates blind spots by providing real-time visibility into OT assets, connections, communications, protocols and more.

 The Nozomi Networks platform enriches sensor-derived OT and IoT device profiles with AI-powered detailed asset information from our Asset Intelligence feed to deliver a near 100% accurate asset inventory that is always up to date.

Continuous Monitoring

Real-time continuous monitoring of your network and connected assets is the lynchpin of OT/ICS security. The sheer volume of OT and IoT devices with specialized hardware, uncommon or proprietary protocols, and no built-in security features make them much harder to monitor and manage than traditional IT systems.

Continuous monitoring encompasses key cyber capabilities such as asset inventory, passive deep packet inspection as well as safe, active dat a collection, vulnerability mapping and prioritization, and anomaly and threat detection. It enables you to catch potential incidents before they impact your operations. If an attack or accident does occur, information from continuous monitoring helps you better understand the magnitude of the impact and how to respond.

‍

‍