Introduction

Today’s industrial control networks are a hive of interconnected devices designed to work together as a whole. If the mechanism fails at any point, it can trigger a serious domino effect. For example, communications systems are needed to advise power plants on the amount of electricity available in the network and to regulate its production. A hospital depends on its own networks to send diagnostics to customers and a car factory has complex robots that are also interconnected. Although not everything is accessible on the Internet, there are many ways to access these environments and the risk is growing exponentially.

In general, each of the 16 Critical Infrastructure Resources (CIKR) are highly interconnected and are generally affected by similar vulnerabilities and attack vectors.  Securing CIKR is difficult due to many factors. These environments were initially planned to be independent, so no online defense was required or implemented. They also manufacture goods and operate non-stop for thousands of hours, so downtime, except for repairs and patches, would have a significant impact on the business. Few hospitals upgrade an X-ray machine if it works and does its job, nor does a grav conveyor or uranium centrifuge. This is a problem because old hardware and applications are prone to create problems when exposed to modern attacks.

CIKRs have been reluctant to adopt newer technology because their design has been able to reliably deliver a result that is necessary for our modern society over the years using their own protocols, processes and security systems (however old they may be). The vast majority of WO systems operate on a day-to-day basis without significant error. However, the risk of supporting legacy applications and systems even since the late 1980s is increasingly high.

Medigate

Medigate is our preferred solution for making hospitals and medical centers safe and free from cyber threats. It identifies the nature of the attack so the user will have the ability to prevent a rash action or be targeted. The clinical context will help in identifying the development of chaotic human behavior. Device profiles will help you manage device lifecycles and offer additional network security as a result. Medigate and Check Point have come up with an advanced security solution for implementing the Internet of Things (IoT) and IoMT networks. The combined solution of Check Point with Medigate establishes quick and effective security monitoring for Hospitals. The key features include:

• Realistic and holistic medical device registration.
• Mapped-automated anomaly detection.
• Policies are generated from device attributes.
• “Single pane of glass” for all content produced by Medigate on Check Point Smart Console.
• Automatically activating IPS flagging of known Internet of Things exploits.

Security experts wonder whether the security mechanism of online hospitals hasn’t been developed differently. This should be seen as another hint that plenty of legacy networks were never made with data security in mind, placing vital resources and lives at risk. Of course, layers of Cyber defense safety can be added today. The only real difficulty is to design and enforce appropriate layered layers of internet security. Another way to do this is to bring security programs into applications. This would be the safest decision in the long run. Long story short, the transition will take a long time. Updating the equipment of such facilities would come with an equal magnitude of risks as the installation of security systems.

Medigate’s passive platform can be installed by hospitals and security system integrators very easily and is integrated with Check Point’s R80 management system and Security Gateways. Once connected, the medical device security platform shared the identification information of the device and application information with Check Point’s Smart Console. This enables a full view of the screen for a screencast of both devices. Due to granular visibility in surgical devices, medication’s effectiveness is assured. Medigate takes advantage of deep packet inspection to monitor devices by specific identifiers, including setup, usage, performance, and location. This enables both systems to be displayed simultaneously to the Check Point Smart Console, removing the need to flip back and forth between dashboards.

The ability to tag medical devices by connectivity type, model name, and vendor enables more granular policies management. Medigate checks what is changing in the network every hour to ensure that the tags stay current.

Tenable.ot

The heart of a company is a computerized network of controllers that transmit and receive commands. Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs) are industrial equipment that acts as the bedrock of industrial processes. Operations infrastructure now has a large scale attack surface and multiple attack vectors. If we are not able to monitor access to the info, there is a strong risk of getting targeted.

Tenable.ot (formely know as Indegy ICS) is designed to protect enterprise networks from cyber threats, malicious insiders, and human error. Our solution also offers vulnerability identification and avoidance, asset tracking, reporting, and managing the setup of a Wi-Fi network. Industrial Control System (ICS) protection and protection is improved dramatically. The approach provides a clear situational understanding across all departmental locations.

When making investment decisions in OT systems, the cost is still a concern. In order to finance the initiative, we must transfer the costs to users of the services. These innovations are not affordable since the users of the goods produced by this technology have fixed-capital costs included in the cost of goods sold. Increased investment in technology along with its short life span would be costly. Many of the costs of recycling would not be passed down to consumers because of federal legislation. The sector has failed to come to a consensus about the consequences of protecting their OT processes, and how to finance those improvements over the decades.

Just recently no evidence there needed to be special strategies developed to defend against cyber-attacks. On the rise are cyberwar scenarios and as a result, users and companies should be safe as well. The urgent need is for authentication mechanisms to protect UTM/OTM so that system administrators can protect and safeguard their systems from end to end.

Integration of QRadar SIEM

QRadar is a security information solution that offers real-time monitoring of the IT networks. We offer a broad variety of QRadar solutions including core SIEM parts and associated additional hardware.

The key feature of the QRadar SI Platform allows the acquisition of security information in real-time. The solution will gather data from attached logs to analyze abnormalities and produce disturbing warnings until a security threat is identified. This unique appliance recognizes, evaluates, and tracks security, enforcement, and policy threats in networks. It allows network administrators and others to decide on proactive network safety initiatives.

This module scans your computer network for bugs, as well as looks at the data obtained from other hackers (such as Nessus and Rapid7). Using our system to address network security issues. In addition, this lists the index of vulnerabilities that can be further used in connection rules and reports by IBM QRadar Vulnerability Manager. This module would help you inspect your computing devices within hours or even minutes.

Ensuring security using Next-Gen SIEM

• Security vendors will use machine learning and artificial intelligence approaches to bypass old security tools that are using static laws. You can deter unknown attacks by using a big data analytics-based next-gen SIEM service. Machine learning systems evolve easily and are capable of identifying advanced threats that law- or signature-based detection systems can’t identify.
• Behavioral analytics can be used to track insider danger and spying practices. Understanding the entire body of “Behavior Anomaly” is a key to identifying an insider danger at an individual and community level. Insider attacks stem from breaking into access rights they have been given. These malicious actions may be identified using a next-gen SIEM that introduced powerful behavioral analytics.
• Good emergency response systems are important to disaster management. Cyber threats that are not stopped are also had detrimental consequences. In delivering and sustaining company instruction on the procedures to conduct in the event of an assault, your organization minimizes the harm of an attack.
• Physicians should ensure their medical data stays private and limited to approved persons. The EMR documents contain health information, so it is important to keep the medical details private. Usually, Legacy SIEMs enable organizations to mix confidential patient data with other IT data as well as enforcement details a next-gen SIEM solution offers all of the privileges required to preserve data security, such as anonymization of data, role-based access management, data filtering or erasure, and a full audit trail.
• Healthcare companies are subject to more legislation in today’s culture. Next-gen SIEM technologies deliver out of the box and ad-hoc reporting to satisfy regulations like HIPAA, HITRUST, GDPR, and others.

Conclusion

Healthcare practitioners are mindful of the necessity of preserving patient records. Healthcare security is under attack by both external and internal threats, making it imperative to protect individuals Personal Health Information (PHI). There has been a substantial rise in the cost of healthcare, and companies are being targeted for their information and results. The organization often faces stiff regulatory pressure which punishes careless or mischievous mishandling of data.

We must keep in mind to provide sufficient protection in our enterprise climate. This form of networking can help us learn more about what is happening in our machine as well as the internet. One of the most common tracking and analysis techniques is Security Information and Event Management, which collect information such as computer device events and archive and process them. Special attention should be paid to installing SIEMs in OT networks and the peculiarities of these networks should be borne in mind. We can help you to deploy and integrate IPS, SIEM, and IDS. Contact us!

Many of our customers are planning to start using Red Hat OpenShift, our preferred container orchestration platform. Its advantages can be summed up in that it allows a progressive modernization of existing applications and the deployment of many others that, for what to deny, with a design based on micro-services are imposed on many new IT architectures. Just thinking about never having to “prepare” a machine again (installing operating system, configuring network, security, installing libraries and dependent software) every time we want to deploy an environment justifies giving this technology a try.

Kubernetes
is to containers what OpenStack went to Cloud environments. An open source solution, which allows us to share a portion of the infrastructure available in our data centers: servers, networks, storage in resource pools on which to deploy, automatically various workloads. Through a self-provisioning portal, our developers will be able to not only deploy the environments they need to make their applications work perfectly, but also automatically and continuously verify that those applications are working properly. If a developer’s “commit” at the last minute of the day causes a bug, you can go back to the previous day’s version without anyone having to intervene.

If we add to this the ability to make gradual deployments, where a small percentage of users enjoy a new version of our application while the rest continue to use the latest stable version; high availability that works without any additional configuration, resource allocation (developers, memory, CPU, disk space, IP address assignment) per project, or the ability to measure in real time what part of our infrastructure we are using, at what level of efficiency and with what results, few system managers will say no to such a wonder. Not forgetting the ability to automatically scale applications by adding or removing containers as needed.

Luckily or unfortunately, noor all is in the hands of the system managers. What about security? What do CISOs think? Let’s to go over some “myths.”

OpenShift is tremendously safe by design. In our opinion, its basic technology (containers) is as secure as the Linux Kernel is at all times. That is, container processes are separated by linux kernel “namespaces”, the resources they use by “cgroups” and their security, and their context by SELinux. It’s powerful, yes, but we’re still sharing a kernel among many containers in each one. and the kernel needs to be patched, also for security reasons. The inclusion of RHCOS (Red Hat Core OS) has allowed us to make great progress in recent times in terms of the security of the operating system on which this Kubernetes distribution runs. However, since the RHCOS nodes are intended to operate with little change, it is important that any security-related improvements to those nodes are done with extreme care. it’s not going to be that we get the opposite effect.

The images we download are always verified and your code audited by Red Hat. Well, actually access to container images (downloaded or own) are managed in a similar way to RPMs. There are public or private repositories that we connect to, with their keys and their signatures. Vulnerabilities keep coming out every day so we need to have some kind of solution that monitors the contents of the container images available in our repositories, especially images downloaded and installed in our environment.

OpenShift supports JFrog Artifactory, Black Duck Hub, and Docker Trusted Registry. Red Hat CloudForms SmartState can also be used to mark vulnerable images in such a way that OpenShift prevents those images from being used. They are also useful for applications that perform static application security (SAST) testing and dynamic application security (DAST) testing, such as HP Fortify and IBM AppScan.

OpenShift has a robust and secure authentication system. Each OpenShift cluster actually uses user, group, and role accounts.

To manage each user’s access to OpenShift components and be able to verify each user’s identity, the cluster will connect to different identification providers (OpenID, LDAP, Active Directory, Github, etc.). Each of which will have its own configuration, advantages and disadvantages.

Isolation of networks and communications between OpenShift projects is sufficient. It is robust, because it is based on the network components of Kubernetes, but there are operators and plug-ins that can help us isolate the different networks or give dedicated accesses to certain network cards using technologies like SR-IOV. Plugins such as Multus-CNI that allow this and other functions, complementing the features of the Cluster Network Operator (CNO), the CNI’s “Container Network Interfaces” and CoreDNS .

Interested in knowing more about OpenShift? You may be interested in our three-day intensive Red Hat OpenShift 4.X course. We also offer official IBM training if you want to deploy IBM Power Systems servers.