Trusted Cybersecurity for OT Networks - PacketViper

Deception360 for OT
Better security outcomes without unplanned downtime

Deception360 for OT is a lightweight, agentless security solution that provides automated threat detection, prevention, and response without the risk of unplanned downtime. It can passively monitor OT or ICS networks while providing the capability to alert and respond to threats. The solution gathers intelligence on network threats that are quietly lurking on the network listening as well as those performing reconnaissance and moving laterally. Either way, it eliminates false positives. DEception360 for OT is not solely based on known attack signatures. OT security operations have the option to start in a passive mirror-mode and graduate to an in-line deployment once operators are comfortable. However, once in-line it can respond to attacks at wire speeds, both within a segment or across an enterprise, protecting critical infrastructure and preserving process uptime.

Learn More >> Get the White Paper Get the Product Brief

OT and ICS Security Challenges

Increasing IT and OT convergence

As OT networks converge with IT environments, increased vulnerabilities result from these interconnected systems. Therefore, a new approach to how best to protect OT infrastructure components is required.

Security and asset discovery needs

Asset discovery, anomaly detection, and real-time alerts are both vital to operational technology security. Thus, OT security systems that start in passive detection-only modes should offer a path to in-line prevention capabilities.

IT security practices may not translate

OT systems frequently cannot be assessed or scanned like IT assets. Doing so may result in production outages or unwanted physical impact. Because of OT system criticality, taking action based on a false-positive is not an option.

Managed by different departments

Security should be a shared responsibility but the differing core missions of IT and OT can cause misalignment. Also, vendors may control the OT system and patching promptly – or at all – may not be an option.

Deception360 for OT is designed to support overall equipment effectiveness (OEE)

OT Security from PacketViper

OT network segments can be easily saturated with lightweight, software-based OT sirens, sensors, and decoys that blend into the fabric of an OT network. This increases transparency across the OT network while providing high-fidelity alerts. Over time, as the solution is moved in-line, OT security managers can automatically prevent threats without manual intervention at a low cost.

Deception360 for OT overcomes traditional OT environmental challenges presented by IT systems. OT systems typically cannot be assessed or scanned like regular IT assets without generating false-positive results, resulting in unplanned downtime threatening OEE. Based on the mission-critical nature of OT systems, taking actions based on false-positive data is not an option.

Deception360 for OT features:

Lightweight, agentless non-disruptive solution
Configurable OT Sirens and decoy
Vendor agnostic ability to match device in use
Option to evolve from mirror mode to in-line mode
Supports regulatory compliance (NIST, NERC-CIP)
Enterprise-wide orchestration and emergency response
Forensics, analytics, and analyzers.

Aligning IT and OT

Deception360 for OT strengthens and aligns OT and IT security efforts. The solution improves visibility and gathers intelligence on network threats that are either quietly lurking and those performing reconnaissance and moving laterally. Operators have the option to respond to attacks at wire speeds.

Once security teams are comfortable with Deception360 for OT, responses can be configured. These response capabilities range from alerting, throttling communications speed, and active blocking of threats. Because of this, false positives are eliminated.

OT Security with enterprise-wide orchestration and emergency response

Use Deception360 for OT for enterprise-wide emergency response. In the event of an emergency, a central authority can immediately apply threat prevention rules to all locations. After that, once the threat has subsided, each location’s threat prevention rules can revert to their dormant state.