Blog
July 7, 2022
CTO, SynSaber
With so many governmental and regulatory group requirements for OT network security monitoring emerging in our industry, it can be daunting to consider how to implement a solution at scale effectively.
Here’s a quick breakdown of what the guidelines and orders actually mean, and what you can do to meet them successfully.
OT Network Security Monitoring for NERC CIP Regulated Utilities
Whether it’s Executive Order 14028 or FERC NOPR “Internal Network Security Monitoring for High and Medium Impact Bulk Electric System Cyber Systems,” — there is increasing pressure on utilities.
They not only have to monitor their industrial perimeters, but within those trusted zones, they must accomplish three main objectives:
Objective 1: Establish Baselines
Address the need for each responsible entity to develop a baseline for their traffic by analyzing expected network traffic and data flows for security purposes.
Objective 2: Detection
Address the need for responsible entities to monitor and detect unauthorized activity, connections, devices, and software inside the CIP networked environment (i.e., the trust zone).
Objective 3: Packet Capture
Require responsible entities to:
- Log and packet capture network traffic
- Maintain sufficient records to support incident investigation
- Implement measures to minimize the likelihood of an attacker removing evidence (TTPs) from compromised devices
The challenge has always been how to effectively implement these types of visibility solutions at scale, at the edge, and in a way that seamlessly works within your existing monitoring infrastructure.
Passive & Accurate OT Network Monitoring with SynSaber
🚨 Shameless Plug Alert! 🚨
If you’re responsible for ensuring compliance with government regulations, I’d be remiss if I didn’t mention that SynSaber can help you in those efforts.
Our Saber sensors were purpose-built for OT environments, using a single codebase with an ultrasmall footprint capable of harnessing data from the edge. (Read about our Reference Architecture in this blog).
SynSaber is designed to work at scale and at the edge, focusing on safe, passive OT network monitoring as the primary data source.
Since we install at the edge, SynSaber is able to more accurately provide:
✔️ Complete Asset Inventory
Edge network data analysis provides more complete and comprehensive asset information. Accurate asset details are the bedrock of more complex baseline and behavior analysis you can’t get anywhere else.
✔️ Detailed Baselines
Analyzing the “east to west” network traffic equates to more detailed baselines. This, in turn, provides incredible insights into normal and anomalous traffic.
✔️ Precision Packet Processing
You’ll experience no packet loss with SynSaber edge processing. This level of precision enables accurate inventory, baselines, and detection where others fall short.
Frictionless & Safe OT Monitoring
SynSaber founders have worked alongside asset owners in their compliance journey, performing plant asset walkdowns and collecting evidence for audits. While regulatory compliance isn’t the sole mission of our software, it’s an important part of what we do.
And we know that it’s important to asset owners too.
Don’t let legacy solutions fatigue you with expensive hardware requirements and lengthy deployments.
Reach out through our Contact form. My co-founder and I would love to show you how SynSaber can empower your OT operations with rapid deployment, integration, and compliance.
~Ron 💜🚀
Become a Subscriber
SYNSABER WILL NEVER SELL, RENT, LOAN, OR DISTRIBUTE YOUR EMAIL ADDRESS TO ANY THIRD PARTY. THAT’S JUST PLAIN RUDE.
