Rolling in the Deep: Why OT Specific DPI is Necessary for Complete Operational Awareness

No ratings

Presented at s4x17 2017 by

Matt Cowell

In order for anomaly detection to be effective, it needs to holistically discern deviations from ‘normal’ that includes application level details. DPI technology supports this by providing visibility and controls to the critical commands and values shared between devices, networks and machines that define how the overall operation behaves. This requires the DPI technology to fully parse and understand the protocols used for this communication with no impact to the operation. This session will highlight how CyberFence’s DPI functionality can provide enhanced visibility and controls filling the voids left by existing ICS devices and technology. Hear how this technology can be used to enforce an application whitelisting policy (with relative ease) that protects embedded devices at the network layer. We will also discuss how CyberFence can also increase network visibility for external software based anomaly detection tools. Also make sure to listen closely for flag clues as we reference implementation examples from the S4 Capture the Flag (CTF) where CyberFence technology is protecting a Variable Frequency Drive (VFD) and a Building Automation controller for two different challenges!