Respond Quickly and Recover With Confidence.
OT incident response with SealingTech & Garland Technology.
Security Challenges Content
OT incident response is inherently different from IT incident response due to the different devices, communication protocols, and attack techniques used by threat actors to penetrate critical infrastructure environments. With regard to industrial control systems, any sort of disruption due to cyber attacks can be more than just lost revenue and system downtime. In these types of environments, human life and environmental safety can be at risk, which is why it is important to ensure that mission-critical infrastructure is secure and running properly.
It is typical to come across legacy equipment in industrial environments due to strict restrictions on the installation of software and hardware in OEM-supported systems that operate critical processes. This means that incident response teams must be prepared with the ability to collect traffic when Layer 2 switches are unmanaged, unavailable, or potentially need to utilize media that would otherwise be considered outdated.
Key Solution Benefits Content
For Assessment and Incident Response (IR) teams to have the equipment needed to perform a variety of detection, forensics response, and recovery activities, they turn to Fly-Away Kits stocked with Garland Technology Network TAPs and Aggregators, Sealing Technologies (SealingTech) servers, Intrusion Detection Software, and other best of breed tools to ensure the team can respond to any scenario they face.
When an IR team enters an ICS environment, they can use a Fly-Away Kit to not only detect and mitigate the effects of a cyber attack but also act as a temporary SEIM solution. The hardware is designed to provide the infrastructure and computing power needed to establish a basic level of cybersecurity that can last for months rather than just a few days or weeks. This allows organizations to analyze their environments and build and deploy a comprehensive cybersecurity solution across their enterprise. In addition, the kit brings additional value as IR teams can utilize it for future IR deployments, enhance a growing network, and add extra layers of protection when required.
Garland EdgeLens Solution
Garland’s EdgeLens series is an advanced bypass TAP with built-in packet broker functionality that centralizes network traffic, making network tools more efficient by sharing network traffic with monitoring and security tools. EdgeLens provides visibility for a hybrid configuration of an active, inline network device and out-of-band tools, such as LiveAction. EdgeLens provides identical network traffic streams through the active inline device and to the capture engine of LiveAction LiveWire or LiveCapture. The benefits of both devices seeing the same traffic are:
• Correlated data for real-time monitoring and root cause analysis using network packets.
• Historical look back and playback of the network traffic.
• Validating and updating network policy changes and spotting anomalies.
• Network data recording for compliance and security forensics.
• Root cause analysis for application and network related problems.
TAP -> TOOL
Our passive data collection approach protects networks without adding risk or workload. Designed for OT/ICS environments, it uses Garland Technology Network TAPs for 100% network traffic access, aggregated via a Network Packet Broker. Sensors preprocess data for real-time threat analysis and offload to analytic nodes for deeper analysis. This technique allows passive asset inventory and event identification, with full packet capture ensuring responders have access to crucial metadata and full payloads for thorough forensic analysis.
About SealingTech
(NYSE: PSN), rapidly delivers innovative cyber security solutions that modernize, protect, and defend the networks and systems of the Federal Government and private industries. Proudly veteran-founded, SealingTech uses vast cyberspace experience and knowledge to provide cutting-edge research, engineering, and integration services that support the United States and its allies. For additional information, visit sealingtech.com.
- How It Works
- Bypass TAP Benefits
- Full PDF Solution Brief
- How It Works
- How It Works
- How It Works
Bypass manages the availability of inline tools, preventing a single point of failure in the network by “bypassing” the device in the event it fails or needs to be updated. Reducing network downtime. Bypass is unique to the other TAP modes, as it is an inline use case not out-of-band.
