OT & Industrial Cybersecurity Solutions
Overview
Prepared by: Kutay Kelleci – OT & ICS Solution Engineer
2024
©2024 OPSWAT, Inc. Proprietary and Confidential
3000 Customers
1M Academy Users
1600 Customers 2M CIP Cyber Users
30k Academy Users
CIP Cyber Launch
[Link] Acquisition
Cloud Central Management Launch
20+ Years of eHacking Acquisition
Cybersecurity Innovation Academy 3.0 Launch
Bayshore Acquisition
and Growth $125M Investment
Impulse
Acquisition
OPSWAT Academy
MetaAccess Founded
MetaDefender Email Gateway
OESIS
Founded
2002 2023 2026
Professional Services OEM Enterprise Critical Infrastructure Protection
---------------
OPSWAT Global Presence
London,
United Kingdom Hamburg, Germany
Veszprém, Hungary
Thun, Switzerland
Madrid, Spain Timișoara, Romania
Tokyo, Japan
San Francisco, New Jersey, USA Mumbai, India
California, USA North Carolina, USA Taipei, Taiwan
Dubai,
Tampa, Florida, USA
United Arab Emirates
Ho Chi Minh City, Vietnam
Singapore
Sales Offices Support Offices R&D Centers
OUR MISSION
We Protect the World’s
Critical Infrastructure
©2024 OPSWAT, Inc. Proprietary and Confidential
What is Critical Infrastructure?
Chemical Commercial Communications Critical Dams Defense Industrial Emergency Energy
Facilities Manufacturing Base Services
Financial Services Food and Government Healthcare and Information Nuclear Reactors, Transportation Water and
Agriculture Facilities Public Health Technology Materials and Systems Wastewater
Waste Systems
MetaDefender OT Security
Solution
• A rapidly deployable All-in-one device for visibility
into OT/ ICS environments through asset discovery
and inventory, network visibility, anomaly / threat
detection, vulnerability management, and security
compliance.
Differentiators
• Ease of use
• All in one form factor
• Active + Passive in a single appliance
• Actionable alerts
MetaDefender OT Security
• Rapidly Discover Devices and Build Asset Inventory
• Immediately Explore Connectivity and Visualize Network Map
• Continuously Monitor Network to Detect and Alert on Threats and
Anomalies
• Constantly and Objectively Address OT Vulnerabilities and Risks
• Structured and Streamlined Risk Alert Workflow
• Global, Regional, and Industry Regulatory Compliance Reporting
• Comprehensive and Customizable Dashboard
• Simple deployment, OT-Friendly, and Easy to Use
Use Cases
✓ Asset Inventory and Asset Management
✓ Network Connectivity Mapping
✓ Intrusion and Anomaly Detection
✓ Vulnerability Management
✓ Regulatory Compliance Reporting
✓ Supply Chain Visibility
MetaDefender Industrial Firewall & IPS
Solution
• Protection for at risk devices that control physical
process by safely segment/zoning ICS networks to
stops malicious threats
Differentiators
• Automatic configuration and setup
• Deep inspection of ICS protocols
• ICS safe licensing and failure modes
• GE native protocol support
• Network transparency (L2)
MetaDefender Industrial Firewall & IPS
Industrial IPS/IDS – cabinet-level security for OT assets
Zone level protection from unauthorized config changes, device resets, Otfuse Lite OTfuse
device reads, logic updates
Features:
• Proprietary support for GE protocols and assets (CE iFIX / Cimplicity)
• A physical device that sits in front of critical industrial endpoints protecting
PLCs, RTUs, VFDs and other network connected devices
• Automatically configured Industrial Intrusion Prevention system (IPS) /
Intrusion Detection Systems (IDS) enforces normal operations
• Actively eliminates threats to OT assets in real-time
• Your last line of defense for protecting plant assets from unauthorized or
unintended (mis)use – segments the Industrial floor
• OTfuse appliance can protect up to 15 devices; OTfuse Lite up to 3 devices
MetaDefender Kiosk Freestanding Kiosk
Challenges
• Lack of control of inbound and outbound
content across critical networks
• Compliance and reporting for removable
Wall and Stand
media security Mountable Kiosk
• Supply chain security for removable
devices and content
Solution Mobile Kiosk
• Industry leading enforceable end-to-end
removable media security solutions
• Turnkey setup, intuitive configuration, and
management
• Modular deployment configurations easily
tailored to fit any critical environment
MetaDefender Kiosk
Benefits
• Enforce scanning security policies across sites
• Improve visibility and management of removable
devices
• Support a broad range of compliance requirements
Features
• Advanced detection, multiscanning 30+ engines, file
vulnerability, country of origin, deep content disarm
and reconstruction (CDR)
• Enhanced data policies: Data Loss Prevention (DLP),
enforcement of scanning policies, visitor management
• Scan 20+ removable media devices: scan floppy disks,
SD cards, USB and more
MetaDefender
Media Firewall
Challenges
• Lack of enforcement of USB and removable media
scanning policies where software cannot be installed
on the asset
• Concerns with relying solely on a written policy
Solution
• Plug-and-play appliance to secure portable media
usage in critical infrastructure.
• Prevent USB portable media from mounting unless
scanned by a MetaDefender Kiosk
OPSWAT Media
Validation Agent
Challenges
• Concern with relying solely on a written policy
• Lack of technical enforcement of USB and
removable media scanning policy
Solution
• Threat prevention policy enforcement for access
to OT end points
• Prevent USB portable media from mounting
unless it was scanned by a MetaDefender Kiosk
MetaDefender Managed File Transfer (MFT)
Challenges
• Increased risk with improper file transfer systems
• Lack of rules to block access to file storage
• Need for job function and approval sequences to
authorize inbound and outbound files
Solution
• Secure file storage and retrieval solution built for
OT environments
• Files are re-scanned continuously as virus
definitions are updated to better prevent Zero
Day incidents
MetaDefender Managed File Transfer (MFT)
Secure data transfers for supply chain and IT/OT segment transfers
MetaDefender Vault can be deployed in conjunction with MetaDefender
Kiosk and/or MD Drive for highly secure file transfer and storage
applications where the use of an air gap is required
Features:
• Secure data transfer and storage
• End to End armored pipe for safe data
transfer using TLS 1.3
• Reliable connection SHA256 when hashing
files per FIPS 140-2
• Enables remote uploads, and secure
transfers across network segments
• Multiscan and send sanitized files securely
over a LAN or a WAN network
MetaDefender Managed File Transfer (MFT)
Benefits
• Secure data transfers for supply chain and IT/OT
segment transfers
• Enablacrosses remote uploads and secure
transfers network segments
• Suspicious files are sanitized
Features
• Tiered approval and detail audit log for secure
data transfers and storage
• Scan for malware and vulnerabilities with
30+ engines
• Complete audit trail, record all user actions
for compliance
OPSWAT NetWall
✓ Increased demand for OT/ICS connectivity exposes operational assets to targeted cyber-attacks.
✓ Security provided by firewalls is insufficient. Data-diodes are prone to reliability errors.
01. 02. 03.
Increased OT/ICS exposure Firewall challenges Data Diode Challenges
• Increased demand for • Prone to misconfigurations • Suspect to data loss and
IT/OT connectivity • Complex to manage data overruns
• Need to access real-time • Software based security • Retransmission consumes
operational data network bandwidth
OPSWAT NetWall
Powering Risk-Free Communications to OT and Industrial Assets
NetWall USG – Unidirectional Security Gateway
NetWall BSG – Bilateral Security Gateway
Benefits
✓ More secure than a firewall, more cost effective than a Data Diode
✓ Assured Data Delivery, no Data Overruns or Synchronization Issue
✓ Isolates and protects OT/ICS assets against cyber attacks
Features
No return path – A non-networked serial connection between the NetWall Full Industrial Support – Modbus (OPC DA, A&E, UA), UDP, TCP, File Transfers,
server pairs enforces one-way data flows SCADA systems, Historian and SQL DB replications, and many other protocols
No data loss – Delivery assurance mechanism assures reliable operation and Scalable –Bandwidth from 1 Gbit/s to 10Gbit/s to address current and future
conserves valuable bandwidth requirements
No Overrun– Anti-overrun mechanism eliminates data overflow, Bilateral Applications – NetWall BSG includes a unique mechanism to support
retransmissions, and sync issues data replies, while enforcing full protocol break and physical isolation
Better Approach - Data Diodes and Security Gateways
Unidirectional Bidirectional Optical Diode File Transfer Guard Din Rail Optical Diode
Security Gateway (USG) NetWall
Security BSG(BSG)
Gateway
• Unidirectional data • Bilateral data transfer • Hardware enforced
(supports red to blue • NetWall Optical Diode • Hardware enforced one-
transfer one-way transfer
data flow) • Configured with MD way transfer
• Address wide range of • Functionally similar
• Supports applications Core on Blue • Functionally same as 1U
CI markets and use to USG
such as Database • Secure Cross Domain Optical Diode
cases • Complies with NEI
Replication, Historian file transfer • Not Assured data delivery
• Assured data delivery and government
(no diode is)
Replication, data agency requirements
retrieval • Complies with NEI and
• Assured data delivery government agency
requirements
• Supports harsh industrial
environments
OPSWAT NetWall
Powering Risk-Free Communications to OT and Industrial Assets
Benefits
✓ More secure than a firewall, more cost effective than a Data Diode
✓ Assured Data Delivery, no Data Overruns or Synchronization Issue
✓ Isolates and protects OT/ICS assets against cyber attacks
Use Cases
✓ Secure and reliable real-time access and replication of OT/ICS data
✓ Secure IT to OT file transfers – deliver patches and updates
Seamless integration with MetaDefender Kiosk and MD Vault OT infrastructure monitoring and data replication
MetaDefender IT-OT Access
✓ OT Visibility
• Better than a VPN using SDP Approaches
• View individual user connections to OT devices.
• Protocol-level OT Read/Write granularity
✓ Secure by Design
Protect your OT environment by only
allowing outbound connections over mutually-
authenticated, encrypted tunnels
✓ Easy User Management
Provides built-in RBAC and MFA, for local users,
and users from external directories (e.g. AD,
Okta,…)
✓ Integration with MetaAccess SDP for device
Zero-trust
MetaDefender IT-OT Access
MetaAccess OT Client
MetaAccess OT - Connects user computer to Management
Management
Console and ultimately to their OT
Endpoint Devices.
MetaAccess OT Management
- Configures, manages connections between
the Remote Users primary computer and
their requested OT Endpoint Devices.
MetaAccess OT Gateway
MetaAccess OT
Client - Performs internal termination
MetaAccess OT
Gateway
MetaDefender Drive
Challenges
• Unscanned contractor and vendor
laptops on site
• Unknown threats on transient cyber assets
• Achieving compliance for
cybersecurity regulations
Solution
• Multiscan and inspect Windows, Linux, or Apple OS
• Full HDD offline scan of assets that cannot be
directly installed with security solutions
• Endpoint protection designed for a secure
air gap
MetaDefender Drive
Ensure the security of transient devices and OT assets
Endpoint Protection and Across a Secure Air Gap enables a full HDD “offline”
scan of assets that cannot be directly installed with security solutions
Use Cases:
✓ Scan a contractor’s laptop prior to
servicing the Industrial network
✓ Periodically scan Industrial assets to
ensure their integrity
Features:
✓ USB Bootable
✓ Multiscan and inspect End Point for
Windows, Linux or Apple OS
✓ Threat Protection Dashboard
✓ Ability to transfer a sanitized file to
MetaDefender Vault
Thank You
Kutay KELLECI
OT & ICS Solution Engineer
[Link]@[Link]
©2024 OPSWAT, Inc. Proprietary and Confidential