IT endpoint security agents don’t work in OT because they’re heavyweight and disruptive, can’t understand OT/IoT protocols and aren’t trained on OT environments so detect the wrong threats.

Endpoint security agents are a standard part of IT security deployments, not just on desktop computers, laptops and printers but on the explosion of IoT and remote devices. They’re essential for anti-virus protection and patching. Unfortunately, negative experiences deployingIT-focused agents on OT devices have led to scarce adoption of much-needed endpoint monitoring.

Here are some of the main reasons traditional endpoint agents fall short in industrial environments:

1.重量級で破壊的

Many OT devices and controllers have limited computing power and memory designed to perform specific tasks. Even standard anti-virus agents consume too many resources. IT endpoint security solutions also typically require a system reboot after installation, which means downtime.

2.間違った脅迫

Traditional vulnerability scanning and intrusion prevention systems are designed to detect IT threats using heuristics and machine learning models trained on IT environments. They don’t look for industrial threats, don’t understand industrial communication protocols and don’t recognize OT baselines. For example, while anti-virus solutions provide visibility into workstations, they can’t provide insight into industrial controllers and actuators. Some of the consequences include rendering engineering hardware unresponsive, flagging as malicious legitimate safety protocols or control-system commands, stopping a process or deleting a critical application it perceives as malware.

3. Kernel-level Access

By causing massive worldwide outages on Windows devices onJuly 19, 2024, the now-notorious defective content update to CrowdStrike’s Falcon endpoint sensor made OT stakeholders even more leery of deploying agents in industrial environments.

This incident highlights how critical it is to ensure endpoint security agents built to protect the unique high availability requirements for OT environments are safe and non-disruptive.

Released in 2023, Nozomi Arc does not operate at the kernel level of the host operating system, will never reboot your machines and is very light on system resources.

Safe, Effective Endpoint Security for OT Devices

Nozomi Arc is a safe, non-disruptive security agent purpose-built to protect the unique high availability requirements for OT endpoints. It sheds light on once unreachable, unmonitored areas of your environment where network sensors aren’t practical or are insufficient to detect East-West traffic, USB ports, log files, local network traffic and user activity. 

Benefits include:

• Provides detailed data including device type, vendor, OS or firmware version, serial number, IP and Mac addresses, nodes, zones, protocols used, active accounts and suspicious user activity.
• Detects threats such as infected third-party laptops. Operator errors, malicious insider threats and stolen credentials
• Analyzes event patterns in host log files using SIGMA rules and spot in-progress events involving malware, credential theft, script downloading and more. This context is useful for both operators and security analysts.
• Gives operators troubleshooting information they never had, which goes a long way toward building and trust. With endpoint sensors, they can see not just configuration changes and anomalies but also who’s logged onto a device, what other devices it’s communicating with and what protocols it’s using.

OT エンドポイントセンサーの主な使用例

1.クラウンジュエルの戦略的展開

Suppose network monitoring is overkill for your environment, but you still have critical assets to protect. Endpoint sensors enable you todeploy agents only on those assets, to monitor what matters most. They can beinstalled on hundreds of key endpoints with a few clicks and no reboot.

2.よりスピーディーで手間のかからない展開

例えば、遠隔地の変電所で、1年に1回、来年2月の1時間の停電時にしかスイッチの再設定ができないとします。あるいは、12年前の回線スイッチに空きポートがないとする。この場合も、リブートなしでエンドポイント・センサをインストールするだけだ。

3.低帯域幅、高遅延ネットワーク

貨物船はエンドポイントセンサーの最有力候補だ。接続は衛星に依存しており、ケーブル配備はほとんど不可能だ。

4.単発または短期のモニタリング

契約技術者が接続されている間だけ監視したいとする。彼が接続しているマシンを監視するエンドポイントセンサーをインストールし、彼がログアウトしたときにそれ自体を削除するように設定することができます。

5.オフライン機器の監視

Nozomi Arc は、ホスト・デバイスがトラフィックを送受信していないときでもローカルにデータを収集し、ユーザーがネットワークに接続したときにアップストリームに送信します。これは、フィールド・デバイスやモバイル・ワーカーから詳細な監査証跡を取得するのに最適な方法です。