IT endpoint security agents don’t work in OT because they’re heavyweight and disruptive, can’t understand OT/IoT protocols and aren’t trained on OT environments so detect the wrong threats.

Endpoint security agents are a standard part of IT security deployments, not just on desktop computers, laptops and printers but on the explosion of IoT and remote devices. They’re essential for anti-virus protection and patching. Unfortunately, negative experiences deployingIT-focused agents on OT devices have led to scarce adoption of much-needed endpoint monitoring.

Here are some of the main reasons traditional endpoint agents fall short in industrial environments:

1. 重量級で破壊的

Many OT devices and controllers have limited computing power and memory designed to perform specific tasks. Even standard anti-virus agents consume too many resources. IT endpoint security solutions also typically require a system reboot after installation, which means downtime.

2. 間違った脅迫

Traditional vulnerability scanning and intrusion prevention systems are designed to detect IT threats using heuristics and machine learning models trained on IT environments. They don’t look for industrial threats, don’t understand industrial communication protocols and don’t recognize OT baselines. For example, while anti-virus solutions provide visibility into workstations, they can’t provide insight into industrial controllers and actuators. Some of the consequences include rendering engineering hardware unresponsive, flagging as malicious legitimate safety protocols or control-system commands, stopping a process or deleting a critical application it perceives as malware.

3. Kernel-level Access

By causing massive worldwide outages on Windows devices onJuly 19, 2024, the now-notorious defective content update to CrowdStrike’s Falcon endpoint sensor made OT stakeholders even more leery of deploying agents in industrial environments.

This incident highlights how critical it is to ensure endpoint security agents built to protect the unique high availability requirements for OT environments are safe and non-disruptive.

Released in 2023, Nozomi Arc does not operate at the kernel level of the host operating system, will never reboot your machines and is very light on system resources.

Safe, Effective Endpoint Security for OT Devices

Nozomi Arc is a safe, non-disruptive security agent purpose-built to protect the unique high availability requirements for OT endpoints. It sheds light on once unreachable, unmonitored areas of your environment where network sensors aren’t practical or are insufficient to detect East-West traffic, USB ports, log files, local network traffic and user activity. 

Benefits include:

• Provides detailed data including device type, vendor, OS or firmware version, serial number, IP and Mac addresses, nodes, zones, protocols used, active accounts and suspicious user activity.
• Detects threats such as infected third-party laptops. Operator errors, malicious insider threats and stolen credentials
• Analyzes event patterns in host log files using SIGMA rules and spot in-progress events involving malware, credential theft, script downloading and more. This context is useful for both operators and security analysts.
• Gives operators troubleshooting information they never had, which goes a long way toward building and trust. With endpoint sensors, they can see not just configuration changes and anomalies but also who’s logged onto a device, what other devices it’s communicating with and what protocols it’s using.

OT エンドポイントセンサーの主な使用例

1.クラウンジュエルの戦略的展開

Suppose network monitoring is overkill for your environment, but you still have critical assets to protect. Endpoint sensors enable you todeploy agents only on those assets, to monitor what matters most. They can beinstalled on hundreds of key endpoints with a few clicks and no reboot.

2. よりスピーディーで手間のかからない展開

たとえば、リモートにある変電所では、スイッチの再設定は年 1回の 1時間の停電時しかできないとします。あるいは、空きポートのない 12年前のラインスイッチを扱っているかもしれません。この場合も、再起動不要のエンドポイントセンサーを設置するだけです。

3. 低帯域幅、高遅延ネットワーク

貨物船は、端末センサーの最適な候補です。 貨物船は衛星通信に依存しており、ケーブルの敷設はほぼ不可能です。

4. 単発または短期のモニタリング

たとえば、契約技術者が接続している間だけその技術者を監視したいとします。エンドポイントセンサーをインストールして、その技術者が接続しているマシンを監視し、その技術者がログアウトした際に自動的に削除されるように設定することができます。

5. オフライン機器の監視

ホストデバイスがトラフィックの送受信を行っていない場合でも、Nozomi Arc はデータをローカルに収集し、ユーザーがネットワークに接続すると、そのデータを上位に送信します。これは、フィールドデバイスやモバイルワーカーから詳細な監査証跡を取得する優れた方法です。