System and method for passive assessment of industrial perimeter security

Abstract

A computer-implemented method for assessing and managing network security for a network includes retrieving topology data and network traffic data with a processor, where the topology data is indicative of a topology of the network. The method may further include retrieving network flow data from a plurality of network data collectors via the processor, generating an attack tree based on the topology data and the network flow data via the processor, updating a customer model database with the attack tree and the topology data, and outputting a security assessment based on the attack tree and the topology data.

Description

Background technique [0001] The present disclosure relates to industrial security, and more particularly to passive assessment of industrial perimeter security. [0002] Industrial security service providers in industrial control system environments face multiple challenges when assessing the quality of the cybersecurity configuration employed. In particular, assessing the quality of access control lists (ACLs) employed in a network presents many challenges that may not provide a simplified security assessment if not handled properly. Challenges may arise because the quality of the employed ACLs may be observed differently on different network boundaries for different network regions. Gathering this information automatically presents many challenges. For example, industrial control system network environments often include multiple layers of switches, routers in a highly isolated environment, thus requiring physical connections to each layer for network traffic and configura...

AI Technical Summary

Problems solved by technology

In other cases, network infrastructure and security configuration may be routinely controlled by a third-party IT managed service provider (MSP), with a contractual obligation to limit administrative access to its employees

This can make it difficult to connect through various firewalls, multilayer network switches, routers, etc.

[0005] Traditional network security assessment systems may also lack a mechanism to model the impact of recently disclosed vulnerabilities that take into account the exploitability of networks currently employing security configurations

In other words, although information about vulnerabilities and (offline) firewall configurations is available, there may not be any automated mechanism to correlate this information and warn asset owners about new attack vectors that may target existing Effective ACL execution attack

In addition to the above issues, taking a "periodic firewall configuration audit" approach often exposes the attack surface of a controlled industrial network environment

As exposure increases, so does the risk of attack vectors and malicious exfiltration

Images