Industrial Cyber Defense and Protection

The security of industrial control systems (ICS) like SCADA servers, engineering workstations, Programmable Logic Controller (PLCs) or Human-Machine Interfaces (HMIs), and industry IoT solutions have been hitting the headlines lately. High-profile attacks against critical infrastructure have caused loss of critical services (electricity, water supply, air traffic control…) and environmental damage, and could potentially even lead to loss of life.

Cyber-attacks on industrial systems

ICS systems have traditionally relied on isolation and obscurity to mitigate the risk of digital attacks. With increasing connectivity between classic IT and operational technology (OT) worlds, such isolation gradually weakened considerably, and due to standardization and vulnerability research, obscurity and isolation are no longer a viable defense.

This leaves OT/ICS systems increasingly open to risk and exposes critical services to internal and external actors. With complexity and dynamics rising, things seem to be only getting worse for the defenders.

NIL provides a set of security solutions and services that smartly focuses on industrial defense. Our threat detection and response mechanisms minimize the risks in case of a cyber-attack and enable quick mitigation without disruption to critical industrial operations and processes.

The traditional IT answer to risk management – using historically successful IT preventive controls, such as hardening, patching, SDLC, active vulnerability assessment, tight access control – cannot succeed in the OT/ICS world.

NIL offers a different approach - we observe OT/ICS systems in real time, and quickly respond to any suspicious or anomalous behavior. Our solution was developed specifically for critical infrastructures and industrial equipment and it is based on OT network data capture with anomaly-based detection using completely passive network sensors at the customer site. By creating baselines of known good system behavior, we are able to detect suspicious or malicious deviations as well as the known, specific attacks against the system.

The results of the analysis are fed in real time to our Security Operations Center (SOC) service, where analysts trained in ICS/OT risks and vulnerabilities react to alerts, and they respond to incidents in close cooperation with the customer, helped by extensive automation.