Kaspersky launches operational technology visibility solution

With new EDR functionality in Kaspersky Industrial CyberSecurity, customers can now gain instant visibility on operational technology (OT) security incidents and run response actions.

The solution also helps reveal hidden weaknesses in networks, be it vulnerabilities, misconfigurations or incompliance with policies and regulations.

With the new features of active polling and a physical topology map, organisations can see even more of the assets in their OT network and how they interconnect. These new capabilities and the deeper integration of Kaspersky Industrial CyberSecurity for Nodes and Kaspersky Industrial CyberSecurity for Networks greatly enhance the OT visibility and control, compliance, and threat protection.

IT and OT convergence brings a growing number of connections, equipment and services to industrial organisations. Maintaining control, availability, security and compliance will require a new generation of dedicated cybersecurity solutions.

According to IDC Worldwide IT/OT Convergence 2022 Predictions, by 2024, 30% of industrial enterprises will incorporate centralised security management tools to bridge the IT/OT gap. The renewed Kaspersky Industrial CyberSecurity platform comes alongside this trend.

With EDR in Kaspersky Industrial CyberSecurity for Nodes, a cybersecurity team can track malicious activity, analyse the root-cause through attack spread path visualisation and run response actions on SCADA computers and operator workstations.

The product provides a wide range of response actions that do not impact the industrial process unless there is explicit operator intervention, including quarantining or removing a malicious object, prohibition of running a malicious process in the future and so on.

To ensure the threat does not spread to other machines, security specialists can create indicators of compromise (IoCs) or artefacts to indicate a system has been breached and run a cross-endpoint response based on these IoCs.

The EDR functionality is delivered as part of KICS for Nodes without the need to install additional hardware. It works on any operating system, including Windows XP, and is optimal for industrial networks as it doesn't overload them with traffic and has no impact on ICS hosts, the company states. On top of this, it doesn't require any specific skills from IT or OT security administrators. 

With Kaspersky Industrial CyberSecurity for Networks, customers can implement a risk-oriented approach to cybersecurity. The product can now detect weaknesses that can potentially put OT integrity at risk or cause technology process disruption.

The areas covered include vulnerable network architecture (access to external networks, lack of segmentation, multi-homed devices); weak host security settings (open ports, lack of authorisation, disabled firewalls); obsolete, vulnerable, unwanted, unencrypted protocols and anomalies in network protocols; outdated OS; unauthorised devices; and vulnerabilities in the PLCs. All risks are scored for severity in the management console, so security teams can focus on the most critical ones first.

The updated Kaspersky Industrial CyberSecurity for Nodes is able to automatically audit OT hosts or a group of hosts for vulnerabilities in the software, misconfigurations, and compliance with local or international regulations and corporate policies. The product uses open vulnerability and assessment language (OVAL) content to assess hosts.

By default, the product provides a SCADA vulnerability database from Kaspersky ICS-CERT in OVAL format. Any OVAL database can be used, be it the NIST, CIS or other regulations or custom samples.

Network and device visibility is enhanced thanks to active polling and the industrial network physical topology map in Kaspersky Industrial CyberSecurity for Networks.

Active polling helps to identify assets in OT systems and their configuration, while a topology map visualises the network architecture: how assets are physically connected and communicate with each other.

With this data, OT operators or security teams can quickly understand elements such as where in the network a problem occurs and to what physical object in the production area it refers, allowing them to fix it faster.

Kaspersky Industrial CyberSecurity for Nodes also gives OT security experts a portable USB scanner to use on machines for which policies restrict installation of any software, including cybersecurity products. These can be old endpoints with outdated software or those that are too critical to install something on them. Another use case is subcontractors equipment, which they may use inside the customers OT network.

OT security specialists can use a simple USB flash drive to download the scanner from KICS for Nodes and then use it to scan the isolated machine. The scanner doesn't install anything on the machine but provides information about any threats found on it, so security teams can plan the necessary actions.

As a platform, Kaspersky Industrial CyberSecurity also ensures native integration of all its components, including KICS for Nodes for Windows and Linux, KICS for Networks, and orchestration through a single management platform.

Deeper integration of KICS for Nodes and KICS for Networks enables network alerts enriched with data about a host, its processes and under which user it was launched. IT/OT security teams, SOC analysts and SCADA operators now have more visibility over suspicious actions as a result and can make informative decisions about response actions.

Andrey Strelkov, Senior Product Manager at Kaspersky, says, "With this update, we are empowering our customers with a risk-oriented and compliance-oriented OT security management platform. Kaspersky Industrial CyberSecurity shines the light on incidents and hidden vulnerabilities, misconfigurations and other weaknesses to minimise the risk of disruption to critical industrial processes.

"Along with corporate cybersecurity products, Kaspersky Industrial Cybersecurity is a crucial element of the ecosystem for industrial organisations to protect their assets from any threat vector, whether it exploits IT or OT. And through the native integration of all components in the ecosystem, and with a single management platform, we are gradually implementing the extended detection and response (XDR) concept for industrial cybersecurity in our portfolio."