The Cyberx Platform in Industrial Control Systems Security Solutions

CyberX platform is the simplest, most mature, and most interoperable solution for auto-discovering assets, identifying critical vulnerabilities and attack vectors, and continuously monitoring ICS networks for malware and targeted attacks. What’s more, CyberX provides seamless integration with existing SOC workflows for unified IT/OT security governance.

Product Features:

RAPID NON-INTRUSIVE DEPLOYMENT

The CyberX appliance connects to a SPAN port or network TAP and immediately begins collecting ICS network traffic via passive (agentless) monitoring. It has zero impact on OT networks since it isn’t placed in the data path and doesn’t actively scan OT devices.

RAPID NON-INTRUSIVE DEPLOYMENT

CyberX appliance quickly begins collecting ICS network traffic through passive monitoring when connected to SPAN port or network TAP. Since it is not placed in the data path, it has no impact on OT networks.

CENTRAL MANAGEMENT

CyberX’s Central Manager provides a complete view of all assets which helps in identifying the position of assets based on tailored filters such as type (PLC, RTU, DCS, etc.), manufacturer, model, and firmware revision level. Central Manager delivers a real-time monitoring of OT risk indicators and alerts over all facilities

• It firmly combined with SOC workflows and runbooks
• Central Manager provides centralized deployment of software, threat intelligence, and configuration updates to allow easy moderation of activities and cross-site correlation of threats.

REAL-TIME ANOMALY DETECTION OF ICS THREATS

CyberX platform identifies anomalies through monitoring and several types of analytics engines that integrate self-learning to eliminate updating signatures or defining rules. The software uses ICS behavioural analytics and data science to analyse OT network traffic for anomalies which includes:

• The use of packet structures and field values that violate ICS protocol specifications
• Behaviours indicating the presence of known malware such as WannaCry/ NotPetya
• Policy violations • Operational issues such as early signs of equipment failure; and unusual machine-to-machine (M2M) communications and behaviors.