Focus On Cybersecurity Threats That Really Matter
May 26, 2021
By Carol Jors, Storyteller, Rockwell Automation
With greater connectivity comes greater risk for security threats. These threats can take many forms, from bad actor hackers to well-intentioned mistakes. Cybersecurity events can impact network availability, interrupt operations and halt productivity.
Even with a robust security program in place, protecting your industrial networks against cyber threats requires constant vigilance. Threat detection services can help you monitor and detect these increasingly complex threats.
Threat detection software identifies events that do not conform to an expected pattern or baseline within Industrial Control System (ICS) networks – any activity that may pose a risk to the availability of your system even before it happens. It can also help in determining internal threats or inspecting traffic without disrupting normal production.
Threat Detection and Fine Tuning
A potential challenge of threat detection software is the proliferation of alarms: Too many system alarms are just as harmful as too few. Without the ability to fine-tune your threat detection, you can quickly become overwhelmed with noise – and potentially let bad actors infiltrate your system.
Threat tuning – also called system tuning – optimizes the configuration of the continuous threat detection (CTD) software to help eliminate false positives and prioritize actionable alerts. Threat tuning helps prevent alert fatigue – a dangerous condition that arises when thousands of alerts flood the screen with non-actionable items. The concept is not new – what is novel is how threat tuning is expanding beyond information technology (IT) systems for adoption in operations technology (OT) through a service that allows operators to fine-tune the system themselves.
Saving Time and Effort
Without threat tuning, a system could generate thousands of alerts per shift with fewer than .01% connected to an action, equating to hundreds of hours a year chasing down unnecessary alarms.
“With the right threat tuning software, you can eliminate the 99.9% of alerts that don’t matter so your operators can concentrate only on the messages of value,” said Quade Nettles, Cybersecurity Services Product Manager, Rockwell Automation.
Such clarity in threat detection and the improved response rate improves an organization’s security posture and positions the cybersecurity team for greater long-term continuous threat detect success.
Rockwell Automation and Claroty have partnered to offer comprehensive OT security solutions. The Rockwell Automation Twinsburg, Ohio, manufacturing facility was a proving ground for Claroty’s threat tuning capabilities.
The pilot included IT and OT functions that could experience more than 10,000 alarms daily.
“These results help to quantify the value of threat tuning in the overall CTD investment and specifically, protect ROI,” said Gary Kneeland, Technical Director, Claroty. “While it’s enticing to jump into real-time monitoring, it’s important to include managed services like threat tuning to experience the full range of benefits.”
With the convergence of IT and OT, it’s important to identify cybersecurity risks to industrial assets. And, it’s more important than ever to work with industrial security software providers like Claroty, and managed services providers like Rockwell Automation – companies that fully understand operational functions within industrial protocols and work to help secure and manage industrial control networks.
