What is OT/ICS SIEM?  

Traditional IT SIEM tools combine Security Event Monitoring (SEM) with Security Information Management (SIM) to integrate insight into alerts and events for analysis and incident response from a typical IT cyber security perspective. 

However, OT environments have different types of devices, usage scenarios and skill sets, so an OT/ICS-specific SIEM needs to provide additional operational data insights relevant to those knowledgeable in control systems.  In other words, an effective SIEM is invaluable to OT security teams and engineers.

OT/ICS SIEM platforms integrate the same security functions as their IT brethren, but with operational data to provide a unique risk perspective that traditional IT SIEM cannot do natively. Key additions include:

  • OT/ICS specific threat detection
  • Device performance data
  • Accurate identification of OT assets
  • Alarm management data from process sensors and indicators

While most of the industry is focused on passive network analysis to detect network borne threats, the Verve OT/ICS SIEM aggregates key real-time data directly from connected endpoints, rather than just from network traffic. This includes host logs, syslog, performance information, configuration changes, and network dataflows such as Netflow, but also can be an absolute game changer when detecting threats in OT environments.

This direct endpoint data enables visibility without the need for additional hardware taps or span ports throughout the network, which has a number of advantages including a reduction of implementation costs, but can also be enhanced with complementary data sources provided by passive network detection solutions. 

Verve OT/ICS SIEM

Detect threats, operational anomalies, and compliance gaps to enhance incident response time with an integrated SIEM and endpoint management platform

  • Host Intrusion Detection

    Monitor behavior on the endpoint itself including host logs, syslog, performance and operational alarm data

  • No Hardware Taps or Span Ports Required

    Direct collection of information from endpoints rather than relying on network traffic to infer endpoint behavior and vulnerabilities

  • Performance Monitoring

    Reliability improvements by monitoring real time system data on performance of all devices in the network

  • Network Segmentation Analysis

    Monitoring Netflow, syslog, traffic behaviors to accelerate network segmentation analysis and redesign

  • Security Signatures

    Detections based on known behavioral risks and identified attack signatures that can not only indicate malicious intent, but accidental insider threats (e.g., a write command from a user during operations)

  • Compliance Configuration

    NERC CIP, CIS 20, NIST CSF and other compliance checks standard out-of-the-box

  • 25 Years of ICS Knowledge

    Detection based on experienced gained of monitoring systems for over 25 years

  • DCS and HMI Alarm Data

    Single pane of glass to monitor security and operational risk and gain deeper insight into incident response

  • Endpoint Status Information

    Add endpoint data context to incident response (e.g., user accounts, patch status, installed software, etc.)

  • Third-Party Alarms and Alerts

    Single database for aggregating across anti-virus, whitelisting, backups, change management, deep-packet inspection, etc.

  • Identify Anomalous Behaviors Without Signatures

    Detect variations in behaviors and discover anomalous patterns that may be indicators of compromise or even failing systems

  • Learning Based on Your Process & Assets

    Build baselines of each unique process and related assets to build tailored understanding of what is “normal” in your environment

  • Reduce False Positives with 360° Information

    Cross-check with other data sets such as endpoint status, alarms, etc. to reduce false positives

Why use an OT/ICS SIEM? 

Some clients ask if we can forward our SIEM information to their corporate/IT instance, and, of course, we can. But there is value in maintaining a separate (or isolated) OT/ICS SIEM for several reasons:

  • Unique OT/ICS threat detection and incident response
  • Enable OT personnel to conduct root cause analysis on data
  • Reduce potential security false positives that would be alarming in IT environments, but are business as usual in OT
  • Aggregate operational alarms, device reliability and security data enhances security and reliability
  • Reduce cost by only sending critical log/alert data to corporate log management solutions
  • Accelerate and improve network segmentation and design efforts by monitoring flows and logs
  • Identify potential system failures (or impending issues) that often arise with failing hardware, legacy technology, or over saturated resources

The Verve OT/ICS SIEM also allows for rapid response actions using the Verve remediation platform. As alerts are identified, OT personnel close ports, remove users, patch systems, etc. in a way that is controlled by the OT engineering team to ensure rapid, but reliable event response.

SIEM in the Verve Security Center

Tabs

Detect Anomalies

Detect anomalous patterns in behavior that indicate potential threats in environment

DCS Alarm Management

Integrated operational alarms simplify tasks of operator and improve event and incident response

OT/ICS Signals & Alerts

OT/ICS specific signals create alerts which can be sent to critical parties for vulnerability management, risk and compliance

Request a Demo

Speak with one of our ICS experts to learn how Verve’s SIEM solution makes investigation easier with centralized reporting

Request a Demo