Siemens Teams Up in OT Endpoint Security

Machine language-based endpoint security collaboration with SparkCognition is the latest move by Siemens in security.

Industrial control system (ICS)/SCADA equipment giant Siemens today made its first foray into the endpoint security space with a new collaboration product and service offering aimed at devices sitting in industrial operational technology (OT) networks.
Siemens and machine learning (ML) endpoint security vendor SparkCognition teamed up on an ML-based endpoint protection product and service for devices on plant networks. The so-called DeepArmour Industrial software initially runs on Windows-based devices, and it was built off of SparkCognitions enterprise version of the endpoint security tool for detecting known and previously unknown threats. Siemens will provide custom integration, installation, and security alert analysis for plant networks.
Well take alarms into our environment, analyze them, and help them think about how to respond to any threats, says Leo Simonovich, head of industrial cybersecurity at Siemens. The way we think about this is as a technology-delivery-as-a-service, he says.
Siemens started doubling down on
managed security services
three years ago, adding third-party security vendor technologies to its networking monitoring and security services such as DarkTrace, PAS, and Tenable. Security services, especially cloud-based ones, provide new sources of revenue for legacy ICS vendors such as Siemens.
Simonovich says Siemens endpoint partnership with SparkCognition aims to address a longstanding problem of tracking and protecting endpoints in OT networks. The goal is to give OT networks more visibility into endpoint devices running on them and any threats that land on or originate from those devices.
The product initially supports only endpoints running Windows 2000 and later versions, which includes programmable logic controller HMIs (human machine interfaces) on those platforms. The plan is to ultimately add support for non-Windows and Windows-embedded platforms (including HMIs), both Siemens and non-Siemens equipment.
Patching software in an OT network is a dilemma, from the perspectives of both disruption of operations and software so old that it has no updates. Many of these [OT] assets are not maintained and patched for decades, Simonovich says, so theyre left exposed to attack, especially if they are located in remote physical locations.
Ernie Hayden, an ICS consultant with 443 Consulting Ltd., says most HMIs he sees in factories and plants run on older Windows platforms such as XP and Windows 2000. It would be interesting it that can back-fit into those operating systems, he says of the Siemens-SparkCognition offering.
SparkCognition CTO Sridhar Sudarsan says his company is building ML models for
the endpoint product
to detect and thwart attacks. Were using ML models to train and build features — multiple models based on millions of zero-day data collected over time.
OT networks have increasingly been facing malware infections carried into the plant via endpoints. A Ponemon Institute
study
commissioned by Siemens in 2017 found that 68% of global energy firms had been hit with at least one cyberattack, and 67% say the risk to their systems has increased significantly.
Researchers have tested the waters to see just what the bad guys are after, using honeypots. For seven months last year, researchers at Trend Micro ran a legitimate-looking phony industrial prototyping company with an advanced interactive honeypot network to attract would-be attackers. This
honeypot-on-steroids
successfully lured the same types of threats that IT networks face: ransomware, remote access Trojans, malicious cryptojacking, and botnet-style beaconing malware that infected its robotics workstation for possible lateral movement.
Most recently, Cybereason ran
an ICS honeypot
that got hit with multiple ransomware attacks, stealing data and user credentials as well.
Related Content
Aftermath of an ICS Hacking Contest
How Enterprises Are Developing and Maintaining Secure Applications
Iranian, Syrian Hackers Hit Gas Gauges

RF Hacking Research Exposes Danger to Construction Sites

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really bad day in cybersecurity. Click for
more information and to register
.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Siemens Teams Up in OT Endpoint Security