Top Five Challenges and Solutions of Network Monitoring and Anomaly Detection (NMAD) in OT Networking Environments

 OT Networking Challenges and Solutions

Considering the sudden rise of cyber risks to the OT environment, and increase of newly discovered vulnerabilities and threats posed to these environments, business and asset owners need to address these pressing issues with urgent attention. Moving forward, they have to assess the risk and potential damage to critical assets and other attacks against ICS infrastructures that may cause the organization serious or unrecoverable harm related to loss of production, loss of life, environmental or reputational damage.

This can be achieved with the help of Network Monitoring and Anomaly Detection (NMAD) tools. These tools should be able to perform some major tasks to mitigate threat posed by the Cybercriminals. Also, many OT systems use a wide range of protocols, which might not be understood by some NMAD tools. This can create many challenges as assets owners tend to combine many tools to mitigate these attacks and creating complexity from different vendor offerings these products.

The following top five NMAD challenges provide an overview of the most critical and common challenges to OT networking environments.

 1. Asset Visibility

In any effective Cyber Security environment, keeping the assets current (i.e. software and firmware level, and security configurations) can be extremely difficulty, time-consuming and required experienced technical expertise. Majority of the OT environments are confronted with the same challenges: have a large number of devices from multiple vendors; assets are being added and changed frequently; inability to detect new devices; and many unknown devices that can attract Cyber-criminals that you do not know existing on your network. Security and Network Professional will not be able to completely defend systems against sophisticated cyberattacks, but visibility into these threats will help to minimize security risks.

Hence, a complete and accurate, well formatted, and centralized asset inventory is very key for an effective OT network. An NMAD solution should automatically track all OT assets and immediately visualize the networks for contextual communication flows – revealing who “talks” to who. It should have automatic asset discovery with network visualization abilities. The feature should include up-to-date asset inventory which enhances cyber resiliency and saves time as automated asset inventory identifies all communicating devices.

 2. Detection of Anomalies and Suspicious Activity

Majority of OT networks today are faced with sophisticated cyberattacks due to inability to detect and block unauthorized access to devices operating outside the normal set parameters. Especially, the current effect of zero-day attacks can be so overwhelming. The potential impact that can be achieved by their exploitation and the difficulty of finding and tracking all instances of the vulnerable library is wearisome. If a threat agent manages to get into the OT network, by exploiting zero-day exploits for instance, it may infiltrate the OT assets directly or through a subsequent attack. Unfortunately, many anti-virus and email security products are not able to detect these attacks, causing the adversary or threat agent to silently gather information and cause damage.

An NMAD solution should be able to quickly detect and disrupt threats and anomalous behaviours in OT multi-vendor operations environment. The solution should be able to provide irregularity-based detection to detect ‘zero-day’ attacks and provide the capability to detect OT assets behavior based on asset profile reporting on suspicious behaviours by providing detailed anomaly-based monitoring, so that deviations from the baseline will be detected and alerted.

Furthermore, OT networks need to adopt a solution that has the ability to use and/or combine network traffic and packet matching rules, payload/data content to trigger on signatures of anomalous and malicious behaviours, and custom rules as devised by a particular customer operations team to trigger on specific use cases and scenarios.

Early indicators of attack or compromise (IOC) are crucial to the OT environment. The tools should be able to categorize detected alerts based on threat severity or risk rating. Alerting system should have the ability to aggregate related alerts into a single incident. The detection of all malicious and anomalous activities should not be limited to protocol misuse, malware communication, tunneling attempt, as well as intrusion and hacking attempts from desktops, laptops, mobile devices, etc.

 3. Centralized Monitoring System

The OT network environment is normally made up of multiple vendors devices and applications. These are usually administered and monitored individually, most times from different systems located at different locations. Majority of OT networks have no centralized security management platform across all diverse infrastructure components, as a result, different vendor systems are managed individually.

An NMAD solution should deliver a platform that supports most, if not all the different vendors systems and applications used in the OT network. It should be able to monitor and administer Cyber Security risks and threats from a single pane of glass platform. More so, an NMAD solution should be able to deliver a centralised OT network security management platform – no matter how large or distributed the customer’s processing infrastructure domestically or globally.

 4. Vulnerability Management

There are multiple examples of malware, ransomware and other attacks that have caused financial, operational, and reputational damage to various industries. Potential threats scenarios could be executable files and applications containing malicious codes, or insider misuse of privileges resulting in data leakages, malware infections, and system or process disruptions. Inability to easily detect unpatched devices and to know the patch status of all the IT/OT devices are often presented as an excuse for the limitation of using automated scanning tools that are not allowed based on the threat of disruption in production infrastructure components. It is very difficult to have visibility into security vulnerabilities and potential penetration points in the OT networks without deep network insights into all levels of the OT network.

An NMAD should provide vulnerability assessment capability with supported automated identification of devices with vulnerabilities including severity levels. There should be an easy way to visualize, find, and drill down on asset and vulnerability information. We should be able to have a clear visibility of the known vulnerabilities and notify users when systems installed in the monitored network suffer any known issues. Vulnerabilities should be taken and synchronized from the National Vulnerability Database (NVD) and other sources, and matches based on updateable fields.

 5. Common IT/OT Platform

The major issue in deploying solution across IT/OT networks is the ability to have a common compliance driver across all the network segments. There are hundreds of protocols that need to interoperable across and within these mixed environments. Additionally, there are limited support to integrate the OT network to Security Information and Event Management systems (SIEMs) which typically lives in the IT network.

There is a need for a solution that will provide a unified OT, IIoT and IT security integration and monitoring platform across all the networks. The solution should be easy and fast integrated easily with IT asset, ticketing, identity management systems and SIEMs, as data and security processes are streamlined across all the business network systems. The solution should make the existing infrastructure works better and more effective. Streamline security processes across IT/OT and make it easy to harmonize security data for cohesive response with in-built integrations for asset, ticket, and identity management systems, as well as SIEMs.

 Conclusion

Dexcent with several years of experience in Industrial Control Systems (ICS) and having successfully delivered a number of industrial Cyber Security solutions has noted that modernization of OT network traffic insights is key to OT asset discovery, network monitoring, vulnerability management, and threat detection challenges that are common in the present day industrial Operational Technology (OT) environment. In addition, deploying a modern NMAD solution helps to align businesses’ cyber security goals as well as it hastens processes and better decision making.