Network monitoring provider, Indegy, is partnering with the Open Information Security Foundation (OISF), the nonprofit organization that owns and manages Suricata, a network threat detection engine.
The integration will combine Indegy’s patent-pending active device-based threat detection with Suricata’s open source network threat intelligence to provide end-to-end protection for operational technology (OT) environments.
The companies will collaborate to make attack signatures and rules gathered from industrial networks available and actionable to the broader OT security community.
Attacks such as Triton, Dragonfly 2.0, and CrashOverride/Industroyer showed today’s Industrial Control Systems (ICS), most of which are now connected to enterprise IT systems, are no longer isolated from cyber threats. While open source sharing of threat intelligence on new attacks and signatures is commonplace in IT, it still does not exist in the OT world. The integration of Indegy’s Industrial Cyber Security Suite and Suricata provides industrial organizations with the ability to access signatures and rules from the community and operationalize them.
“As a member of the Open Information Security Foundation, we are joining forces with Suricata to harness the power of open intelligence sharing for addressing complex threats to OT environments,” said Mille Gandelsman, co-founder and CTO of Indegy. “By combining our patent-pending active ICS device querying technology with the Suricata threat detection engine, we are providing customers with holistic protection against lateral attacks that span IT and OT infrastructures. We will also contribute OT signatures to the security community at large.”
The Indegy and Suricata solution inspects every packet in an OT network against a comprehensive signature database for attacks or compromised assets. This advanced threat detection capability spans dozens of categories including suspicious network behaviors, malware command and control, DoS attacks, botnets, informational events, exploits, vulnerabilities, network attacks, exploit kit activity, and more. Organizations can use this intelligence to implement predefined policies or create custom policies that white and/or blacklist specific granular activities that may be indicative of cyber threats or trigger alerts when unintended operational changes occur.
The Indegy-Suricata solution will provide:
• Early warning of reconnaissance activity
• Integrated threat intelligence from a global security ecosystem
• Access to constantly updated signatures from the Suricata community
• Pre-configured rules that provide the best defense for ICS environments
• Automated reporting