Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/13/2016
03:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Startup Focuses On Real-Time Security Monitoring Of Plant Networks

With $32 million in venture capital funding and co-founders from Siemens and Israeli Defense Force research teams, Claroty emerges from stealth.

An industrial control systems (ICS) security startup with roots in the renowned Team8 incubator emerged today from stealth with executives from Siemens, FireEye iSIGHT Partners, and key players in the ICS/SCADA realm - as well as $32 million in venture capital.

Claroty - which has venture backing from Bessemer Venture Partners, Eric Schmidt’s Innovation Endeavors, Marker LLC, ICV, Red Dot Capital Partners, and Mitsui & Co. Ltd. - also officially rolled out a network security monitoring platform for ICS networks, a method of continuously monitoring activity in an ICS/SCADA environment in real-time.

ICS/SCADA security experts long have been calling for network security monitoring as a best practice, but its use remains rare in industrial networks. In the case of the Ukraine power grid attack in late 2015, experts say if the power companies in Ukraine had employed network security monitoring, they would have spotted the attackers before they shut off power. "If they had used network security monitoring practices, they could identify any reconnaissance ... and multiple VPN connections at times that were not normal,” Robert Lee, a SANS instructor and an ICS/SCADA expert, concluded after an in-depth postmortem study of the Ukraine blackout.

Anomalies in data flows are actually relatively easy to detect in ICS networks, which tend to have predictable and static data flows, according to Lee's assessment earlier this year.

ICS operators traditionally have been gun shy about adding security layers to their networks: operations, physical safety, and uptime are priority one in power plants, manufacturing floors, and other industrial sites. But the post-Stuxnet era has served as a wakeup call for the industrial world, serving as a stark example of how hackers can do harm to seemingly isolated industrial networks and operations.

Galina Antova, co-founder and chief business developer of Claroty, is the former global head of industrial security services at Siemens. Antova says during her tenure at Siemens' services business, it was difficult to find security products for ICS/SCADA networks: they were either a point product or not quite a fit for the industrial network. Traditional IT security products often aren't useful in industrial environment because they aren't built for the performance demands of the plant floor, and ICS security startups weren't as well-versed in the industrial space. "We needed more of a platform approach," she says.

Meantime, there's a security shift under way in the ICS sector, she says. "The majority of CISOs at large companies with industrial site components have been tasked with … responsibility for industrial cybersecurity" as well, she says. "We're seeing this push from Boards [of Directors], who are asking, what are you doing about production facilities? How are you securing those?"

According to an executive at a Fortune 100 consumer products company running Claroty's platform and who requested anonymity, network security monitoring is more of "an insurance policy" right now, in advance of threats on the horizon.

"I'm worried about everything" threat-wise, this C-level executive says, but mostly the "inadvertent" threat from an internal users just doing his or her job. "I'm mostly worried about the inadvertent [event], a guy walks onto the plant floor … and helps with equipment, plugs in a USB" and accidentally infects the network with malware that shuts down the network, the executive says.

Network security monitoring also is helping the organization map out its ICS network, including the devices and firmware versions, for example, the Fortune 100 exec says.

Claroty Platform, which includes deep-packet inspection and anomaly detection engines in a virtual machine or virtual appliance format, has actually been in quiet production for about 10 months, at oil & gas, manufacturing, chemical, and food & beverage sites.

The monitoring system stops short of blocking a threat or responding to one: that's up to the plant network security operations team. It employs passive monitoring so it doesn't disrupt plant operations, and includes an enterprise console.

"You can think of it as an IDS [intrusion detection system] for OT, but that's underplaying" its features, says Patrick McBride, CMO at Claroty, and a former vice president at iSIGHT Partners.

It monitors several proprietary and open ICS protocols and products, including Siemens, Rockwell Automation/Allen Bradley, Yokogawa, Emerson, GE, Schneider Electric, Mitsubishi, ABB, and Honeywell.

Claroty was co-founded by former Israeli Defense Force researcher and developer Amir Zilberstein, who also co-founded ICS firewall firm Waterfall Security Solutions; Antova; and Benny Porat, former Israeli Defense Force researcher and researcher at NorthBit.

“We have been keenly interested in the critical infrastructure security sector for the last few years,” David Cowan, partner at Bessemer Venture Partners, said in a statement. “We looked at several companies in the space and were not impressed until we found Claroty. They have the best vision for addressing this unique sector, a very impressive management team and serious depth in both OT and cybersecurity.”

Claroty isn't the first ICS network security monitoring vendor. There's also SecurityMatters' SilentDefense, for example, as well as multiple open-source tools.  

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10102
PUBLISHED: 2019-07-22
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: ne...
CVE-2019-10102
PUBLISHED: 2019-07-22
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
CVE-2019-10102
PUBLISHED: 2019-07-22
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections ...
CVE-2019-9959
PUBLISHED: 2019-07-22
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
CVE-2019-4236
PUBLISHED: 2019-07-22
A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to ...