Indegy extends its active device-based threat detection with Suricata

Indegy announced an integration partnership with the Open Information Security Foundation (OISF).

The integration will combine Indegy’s patent-pending active device-based threat detection with Suricata’s open source network threat intelligence to provide end-to-end protection for operational technology (OT) environments.

The companies will collaborate to make attack signatures and rules gathered from industrial networks available and actionable to the broader OT security community.

Recent attacks such as TRITON, Dragonfly 2.0, and CrashOverride/Industroyer have demonstrated that today’s Industrial Control Systems (ICS), most of which are now connected to enterprise IT systems, are no longer isolated from cyber threats.

While open source sharing of threat intelligence on new attacks and signatures is commonplace in IT, it still does not exist in the OT world.

The integration of the Indegy Industrial Cyber Security Suite and Suricata both strengthens OT networks and provides industrial organizations with the ability to access signatures and rules from the community and operationalize them.

“As a member of the Open Information Security Foundation, we are joining forces with Suricata to harness the power of open intelligence sharing for addressing complex threats to OT environments,” said Mille Gandelsman, Co-founder and CTO of Indegy.

“By combining our patent-pending active ICS device querying technology with the Suricata threat detection engine, we are providing customers with holistic protection against lateral attacks that span IT and OT infrastructures. We will also contribute OT signatures to the security community at large.”

“We are very excited to welcome Indegy into the OISF consortium,” said Kelley Misata, Ph.D., Executive Director of the Open Information Security Foundation (OISF).

“Our consortium members are critical to Suricata’s ongoing success and development. With support from companies like Indegy, our team can keep Suricata ahead of the growing demands for stable and robust security technologies.”

Active device and network OT threat detection

To extend the industry’s active monitoring technology, Indegy Device Integrity, the Indegy and Suricata solution inspects every packet in an OT network against a signature database for attacks or compromised assets.

This threat detection capability spans dozens of categories including suspicious network behaviors, malware command and control, DoS attacks, botnets, informational events, exploits, vulnerabilities, network attacks, exploit kit activity, and more.

Organizations can use this intelligence to implement predefined policies or create custom policies that white and/or blacklist specific granular activities that may be indicative of cyber threats or trigger alerts when unintended operational changes occur.

The Indegy-Suricata solution will provide customers with the following benefits and capabilities:

• Early warning of reconnaissance activity,
• Integrated threat intelligence from a global security ecosystem,
• Access to updated signatures from the Suricata community,
• Pre-configured rules that provide the defense for ICS environments,
• Automated reporting.

Availability

The Indegy Industrial Cyber Security Suite with Suricata integration will be available in the fourth quarter of this year from Indegy and its partners worldwide.