Microsoft Releases Azure Defender For IoT In Public Preview
It focuses on providing security monitoring for specialized device types, applications, and machine-to-machine (M2M), as well as specialized industrial protocols (Modbus, DNP3, BACnet, etc.) within IoT/OT environments.
By adding visibility into misconfigured, unmanaged, and unpatched IoT/OT devices, it makes it a lot harder for threat actors to abuse them to gain a foothold into the networks of industrial and critical infrastructure organizations.
“You can deploy these capabilities fully on-premises without sending any data to Azure,” Phil Neray, Director of Azure IoT Security Strategy, explained.
“Or, you can deploy in Azure-connected environments using our new native connector to integrate IoT/OT alerts into Azure Sentinel, benefiting from the scalability and cost benefits of the industry’s first cloud-native SIEM/SOAR platform.”
The alerts sent by Azure Defender for IoT into Azure Sentinel are triggered by analytics detection engines for protocol violation, policy violation, industrial malware detection, anomaly detection, and operational incident detection included on sensors used to collect ICS network traffic.
These alerts are “based on analysis of both real-time and pre-recorded traffic” and they cover a wide range of incidents including but not limited to:
- Unauthorized device connected to the network
- Unauthorized connection to the internet
- Unauthorized remote access
- Network scanning operation detected
- Unauthorized PLC programming
- Changes to firmware versions
- “PLC Stop” and other potentially malicious commands
- Device is suspected of being disconnected
- Ethernet/IP CIP service request failure
- BACnet operation failed
- Illegal DNP3 operation
- Master-slave authentication error
- Known malware detected (e.g., WannaCry, EternalBlue)
- Unauthorized SMB login
“In addition, you can create custom alerts based on your knowledge of expected device behavior,” according to Microsoft. “An alert acts as an indicator of potential compromise, and should be investigated and remediated.”
Privacy Ninja provides GUARANTEED quality and results for the following services:
DPO-As-A-Service (Outsourced DPO Subscription)
PDPA Compliance Training
PDPA Compliance Audit
Digital Transformation Consultancy
Data Protection Trustmarks Certification Readiness Consultancy
PDPA Data Protection Software
Vulnerability Assessment & Penetration Testing (VAPT)
Smart Contract Audit