Kaspersky
Industrial
CyberSecurity:
solutionoverview 2019www.kaspersky.com/ics

Kaspersky Industrial
CyberSecurity:
solution overview 2019
Attacks on industrial
systems are on the increase

1

The state of industrial cybersecurity
2018, Kaspersky

2Allianz Risk Barometer 20183

PwC: The Global State of Information
Security, 2018

Three in four industrial companies say they believe they will experiencean ICS cyber attack and reasonably 77% of companies rank
cybersecurity as a major priority1. Business and supply chaininterruption has ranked as the number one risk concern globallyfor the past six years; cyber incident ranked second in 20182. For
businesses operating industrial or critical infrastructure systems,
the risks have never been greater. 40% of industrial companies say
the disruption of operations would be the most critical consequenceof a cyberattack3. Industrial security has consequences that reachfar beyond business and reputational protection. When it comesto protecting industrial systems from cyberthreats, there are specificand significant ecological, social and macro-economic considerations.

Operational technology vs. information technology
As defined by automation standard IEC 62443, an Industrial Control System (ICS) is a collectionof personnel, hardware, and software that can affect or influence the safe, secure, and reliable
operation of an industrial (technological) process.
Industrial Control Systems include but are not limited to:••Distributed Control Systems (DCSs), Programmable Logic Controllers (PLCs), Remote Terminal
Units (RTUs), Intelligent Electronic Devices (IEDs), Supervisory Control And Data Acquisition(SCADA) and diagnostic systems.
Associated internal, human, network, or machine interfaces used to provide control, safety,
and manufacturing operational functionality to continuous, batch, discrete, and other processes.

In more high-level terms, any industrial systems infrastructure can be broken down into two domains:••

Information Technology (IT) – systems required for managing data in the context of business goals
Operational Technology (OT) – systems required for managing the physical, industrial processesof industrial automation.

IT security strategies tend to focus on data protection, and to follow the objectives of the “C-I-A” model:
Data Confidentiality, Integrity and Availability. However, for most OT systems, cybersecurity is notabout “data” but about the continuity of industrial processes. So, in terms of the C-I-A model, “availability”
is a main focus of security strategies as applied to OT. This is what distinguishes industrial cybersecurity
needs from those of other systems, meaning that the even most effective classical IT cybersecurity
solution is inappropriate for use on OT systems, putting the availability (and in some cases the integrity)of processes at risk.

1Risks and threats
Despite a growing awareness of the prevalence of cyber-based
attacks on industrial control systems, many IT security models
continue to adhere to the outdated belief that physically isolating
systems (through “airgaps”) and “security by obscurity” is enough.
It’s not – in the era of Industry 4.0, most non-critical industrial
networks are accessible via the internet4, whether or not by choice.
Extensive research by Kaspersky ICS CERT, using data from the
Kaspersky Security Network, indicates that industrial PCs are
regularly attacked by the same generic malware that afflicts
business systems (IT), including (but not limited to) well-known
culprits such as trojans, viruses and worms. In the first half of2018, Kaspersky products across the globe blocked attempted
malware attacks on 41.2% of all Kaspersky-protected computersclassified as components of industrial infrastructure5.
Another rising threat to the ICS is ransomware. The range anddiversity of ransomware escalated massively between 2015 and2017. The emergence of ransomware is highly significant for theindustrial sector – such infections cause high-impact, wide-ranging
damage to critical systems, making the ICS a particularly attractive
potential target – as proven by numerous incidents of ransomware
attacks (especially WannaCry and exPetr infections) hitting ICS/SCADA systems during 2017. In the near future ransomware designed
to attack industrial systems may have its own specific agenda –instead of encrypting data, the malware may set out to disrupt
operations or to block access to a key asset.
As well as generic threats, industrial security must contend with
ICS-specific malware and targeted attacks: Stuxnet, Havex,
BlackEnergy, Industroyer, and infamous Triton that targets Safety
Instrumented System – the list is growing rapidly. As the Stuxnet
and BlackEnergy attacks have shown, one infected USB drive
or single spear-phishing email is all it takes for well-preparedattackers to bridge the air gap and penetrate an isolated network.
In addition to malware and targeted attacks, industrial organizations
face other threats and risks targeting people, processes andtechnology – and underestimating these risks can have serious
consequences. Kaspersky develops solutions and services to help
our customers tackle and manage not only malware and targeted
attacks but also many other cyber incidents and risk factors, such as:
•
•
•
•
•

4

ICS and their online availability 2016,
Kaspersky

5 hreat Landscape for Industrial
T
Automation Systems for H1 2018,
Kaspersky ICS CERT

Mistakes by SCADA operators or contractors (service
providers)
Fraudulent actions
Cyber sabotage
Compliance issues
Lack of awareness and hard data for forensic investigation

2

The need for specialized industrial
cybersecurity
Only cybersecurity vendors who understand the differences between
cyber-physical enterprises and data-oriented enterprises candeliver solutions that meet the unique security needs of industrial
enterprises. Arc Advisory emphasize that Kaspersky performs theunique combination of threat intelligence, machine learning, andhuman expertise that supports agile protection against any kind of
threat6.
Meanwhile, a well chosen solution could help to meet the businessneeds, provide a high ROI for organization and mitigate theoperational risks.7

Kaspersky: trusted
industrial cybersecurity
provider6 rc Advisory: Kaspersky MovesA
Forward with Improved Cybersecurity
Solutions, 2018
Forrester Research: The Total
Economic Impact™ of Kaspersky
Industrial CyberSecurity, April 2019.
https://www.kaspersky.com/
forrester-tei-for-kics

78

 artner Market Guide for Operational
G
Technology Security, July 20189 artner: Competitive Landscape:G
Operational Technology Security,
October 2018

Read the full Gartner
report:https://ics.kaspersky.com/
KICS-cited-in-Gartnercompetitive-landscape-OTsecurity

A representative vendor in cybersecurity and industrial protection8,
Kaspersky is continually researching and developing solutions
that do more to address constantly evolving threats to industrial
and critical infrastructures. From operations management to the
ICS level and beyond, Kaspersky is playing a leading role in helping
industry, regulators and government agencies globally to anticipatechanges in the threat landscape and to defend against attacks.
A trusted security provider and partner to leading industrialorganizations who have relied for many years on our anti-malware
protection, Kaspersky collaborates with well-recognized industrial
automation vendors and organizations, including Emerson, SAP,
Siemens, Schneider Electric, Industrial Internet Consortium andothers, to establish compatibility, specialized procedures andco-operation frameworks which protect industrial environmentsfrom existing and emerging threats, including highly targeted attacks.
Kaspersky has developed a portfolio of specialized solutions toaddress specific industrial cybersecurity market needs – Kaspersky
Industrial CyberSecurity (KICS). Aimed to provide a holistic approach
to industrial cybersecurity, Kaspersky Industrial CyberSecurity
brings value on any stage of the customer’s OT security process –from cybersecurity assessment and training to advanced
technologies and incident response.
In 2018 Kaspersky was mentioned in Gartner report “Competitive
Landscape: Operational Technology Security” as a representative
vendor in 4 categories:••••

OT Endpoint security,
OT Network Monitoring and Visibility,
Anomaly Detection, Incident Response and Reporting,
OT Security Services9.

3Kaspersky Industrial CyberSecurity components

Kaspersky Industrial CyberSecurity
PRODUCTSSERVICES

Industrial Endpoint
Protection

Industrial
Anomaly andBreach Detection

Centralized security
management

Training
and awarenessExpert services andintelligence

KICS for
Nodes

KICS for
Networks

Kaspersky
Security
CenterKaspersky ® Kaspersky ®
Security
Security
Awareness Trainings

Kaspersky ® Kaspersky ® Kaspersky ®
Security
Security
Security
Assessment Respone Intelligence

Kaspersky Industrial
CyberSecurity: services
Our suite of services forms an important part of the KICS
portfolio – we provide the full cycle of security services, fromindustrial cybersecurity assessment to incident response.

Training and awareness•Trainings: Kaspersky offers training courses designed forcybersecurity experts and OT managers/ICS operators, e.g.
during “Advanced Industrial Cybersecurity in Practice” training,participants gain an insight into relevant cyberthreats, theirdevelopmental trends and the most effective methods toprotect against them. Skill-development courses also enablesecurity professionals to further develop their skills in specificareas, including ICS Penetration Testing and Digital Forensics.

•

Awareness Programs: To increase awareness of relevant
industrial cybersecurity issues, as well as fostering the skills
needed to address and resolve them, Kaspersky offers training
games for security managers and engineers. For example,
Kaspersky Industrial Protection Simulation (KIPS) simulates
real-world cyber attacks on industrial automation systems,
demonstrating the main issues associated with industrial
cybersecurity provision.

4Expert services•

Cybersecurity Assessment: For organizations concerned
about the potential operational impact of IT/OT security,
Kaspersky provides minimally invasive industrial cyber­security
assessment. A crucial first step in establishing security
requirements within the context of operational needs, this canalso provide significant insight into cybersecurity levels, even
without further deployment of protection technologies.

•

Threat Intelligence: Up-to-date analytics, collected byKaspersky experts, help to enhance customers’ cyber protection
from targeted industrial cyber attacks. Provided as TI feeds orreports, it meets specific customer needs by regional, industry
and ICS software parameters.

•

Incident Response: In the event of a cybersecurity incident,
our experts will collect and analyze data, reconstruct theincident timeline, determine possible sources and motivation,and develop a remediation plan. In addition, Kaspersky offers
a malware analysis service – within its framework, Kaspersky
experts will categorize any malware sample provided, analyze
its functions and behavior, and develop recommendations anda plan for its removal from your systems and for rolling backany malicious actions.

Kaspersky Industrial
CyberSecurity: centralized
security management
Kaspersky Security Center
To ensure the highest levels of protection from all attack vectors,
security on the industrial floor should operate at both node andnetwork levels. To ensure optimal control, ease of management
and visibility, KICS – like all Kaspersky protection technologies –is controlled via a single management console, Kaspersky Security
Center, enabling:•••

Centralized management of security policies - the ability
to set different protection settings for different nodes andgroups.
Facilitated testing of updates before roll-out onto the network,
ensuring full process integrity.
Role-based access aligned with security policies and urgent
actions.

Kaspersky Security Center ensures ease of control and visibility
not only for industrial layers at multiple sites, but across thesurrounding business floors, as illustrated below.

5Kaspersky Industrial CyberSecurity components deployment
Kaspersky Lab software

Internet

Office Network
Kaspersky
Security
CenterPlant DMZ Network

SCADA/DCS Network
KICS
for Nodes

KICS
for Nodes

Control Network

Kaspersky
Security
Center

SPAN
PLC

PLC

KICS for Networks
KICS for Nodes

Fieldbus

Kaspersky Security Gateway
KICS can also send event-related data to other systems, such
as SIEMs, MESs and Business Intelligence solutions. All detected
events and anomalies are reported to 3rd party systems –including SIEM, mail, syslog servers and network management
systems – through CEF 2.0, LEEF and Syslog protocols. As well as
helping detect, counter and investigate cyber attacks, detailed
industrial network monitoring supports predictive maintenance.

Integration with Human-MachineInterfaces (HMIs)
The solution can send security notifications directly to HMIs,
providing industrial floor workers with specific information for
immediate reaction to and escalation of the cyber incident.

6Kaspersky Industrial
CyberSecurity for Nodes
As an industrial endpoint protection software, KICS for Nodes was
designed to specifically address threats at operator level in ICS
environments. It secures ICS/SCADA servers, HMIs and engineering
workstations from the various types of cyberthreat that can result
from human factors, generic malware, targeted attacks or sabotage.
KICS for Nodes is compatible with both the software and hardware
components of industrial automation systems, such as SCADA,
PLC and DCS.

Threats and risks factors

Kaspersky technologies

Unauthorized software
execution

Whitelisting; prevention or detection-only (registration rather
than blocking) modes

MalwareAdvanced anti-malware signature-based detection engines;
Cloud based detection engine, which uses Kaspersky public
cloud (KSN) or private cloud (KPSN)
File Integrity Monitor

Cryptors, including
ransomware

Anti-cryptor
Host-based firewall
Memory Protection (Exploit Prevention), Log Inspector

Network attacks
Unauthorized device
connection

Device control

Unauthorized wirelessconnections

Wi-Fi network control

PLC programs spoof

PLC integrity check

ICS specifics — airgaps;
false positives for
ICS software/process, etc.

Trusted updates, which tested with software of leadingindustrial vendors; certification of product by leadingindustrial automation vendors.

Application whitelisting
The relatively static nature of ICS endpoint configurations means
integrity control measures are significantly more effective thanin dynamic, corporate networks. Integrity control technologies
featured in KICS for Nodes include:•

Control of application installation and start-up according
to whitelisting (best practice for industrial control networks)
or blacklisting policies.

7

•
•
•
•
•
•

Control of application access to operating system resources:
files, folders, system registry etc.
Control of all types of executable running in Windows
environments, including .exe, .dll, .ocx, drivers, ActiveX, scripts,
command line interpreters and kernel-mode drivers.
Updating of application reputation data.
Pre-defined and customer-defined application categories
to manage controlled application lists.
Fine-tuning of application controls for different users.
Prevention or detection-only modes: blocking any applicationthat isn’t whitelisted or, in “watching” mode, allowing
applications which aren’t whitelisted to run, but registering
this activity in Kaspersky Security Center, where it can beassessed.

Device control
Management of access to removable devices, peripherals and systembusses, based on device category, family and specific device ID.
•••

Support for both whitelisting and blacklisting approaches.
Granular, per-computer, per-user policy assignment to a single
user/computer or group of users/computers.
Prevention or detection-only mode.

Host-based firewall
Set-up and enforcement of network access policies forprotected nodes such as servers, HMIs or workstations. Key
functionality includes:••

Control of access over restricted ports and networks.
Detection and blocking of network attacks launched frominternal sources, such as contractor laptops, which may
introduce malware that attempts to scan and infect the hostas soon as it joins the industrial network.

Wi-Fi network control
This enables the monitoring of any attempt to connect tounauthorized Wi-Fi networks. The Wi-Fi Control task is basedon Default Deny technology, which implies automatically blocking
connections to any Wi-Fi network “not allowed” in the task
settings.

PLC integrity check
This enables additional control over PLC configurations via
periodical checks against a selected, Kaspersky-secured server.
The resulting checksums are compared against saved “Etalon”
values, and any deviations are reported.

8

File Integrity Monitor
This feature is designed to track actions performed within
specified files and folders in the monitoring scopes specified in
the task settings. You can use it to detect file changes that may
indicate a security breach on the protected server – like changes
to SCADA projects stored on a SCADA server.

Advanced anti-malware protection
Kaspersky’s best-in-class proactive malware detection andprevention technologies are adapted and re-designed to meetheavy resource consumption and system availability requirements.
Our advanced anti-malware protection is designed to work effectively
even in static or rarely updated environments. Kaspersky’s
anti-malware covers the full spectrum of technologies, including:
•
•
•
•
•

Signature based malware detection.
On-access and on-demand detection.
In-memory (resident) detection.
Ransomware detection via special Anti-Cryptor technology.
Kaspersky Security Network (KSN) and Kaspersky Private Security
Network (KPSN), enabling the ultimate malware detection service.

Trusted updates
To ensure Kaspersky security updates have no impact on theavailability of the protected system, compatibility checks are
performed prior to both database/component releases and processcontrol system software/configuration updates. Potential resource
consumption issues can be addressed through a number ofdifferent scenarios:••••

Kaspersky performs database update compatibility tests withindustrial automation vendor software on the Kaspersky test
bed.
Your IAV performs compatibility checks.
Kaspersky checks security database updates for you: SCADA
server, workstation and HMI images are integrated into
Kaspersky’s test bed.
Kaspersky security updates are tested on your site andautomated via Kaspersky Security Center.

9Kaspersky Industrial
CyberSecurity for
Networks
As an industrial anomaly and breach detection software, KICS
for Networks operates at the industrial communication protocol(Modbus, IEC stack, ISO, etc) layer, analyzing industrial traffic foranomalies via advanced DPI (Deep Packet inspection) technology.
Network integrity control and IDS capabilities are also provided.
KICS for Networks also helps to solve non-security issues byasset discovery and network map visualization.

Threats and risks factors

Kaspersky technologies

Appearance of unauthorizednetwork devices on industrial
network

Network Integrity Control detects new / unknown devices
Asset discovery, Network map

Appearance of unauthorizedcommunications on industrial
network

Network Integrity Control monitors communications between
known/unknown devices
Asset discovery, Network map

Malicious PLC commands by:• Operator or 3rd party(e.g. contractor) in error• I nsider (fraud actions)• Attacker / Malware

Technological DPI analyzes communications to and from PLCs
and control of the commands and parameter values of thetechnological process.

Network attacks

An Advanced Intrusion Detection System identifies all known
network attack patterns, including the exploitation ofvulnerabilities in industrial software and hardware
Events correlations

Lack of data for investigationand forensics

Forensics tools: monitoring and safe logging of suspicious
industrial network events and detected attacks

Non-intrusive industrial network
traffic inspection
KICS for Networks delivers passive network traffic monitoringof anomalies and network security while remaining invisible
to potential attackers. Installation is as simple as enabling/
configuring port mirroring; easy integration of the software/
virtual or hardware appliance into existing industrial network
equipment is achieved via the SPAN port of the existing switch
or TAP device. KICS for Networks has a modular architecture –sensors can be deployed separately from a central control unit.
10Industrial DPI for anomaly detection
KICS for Networks supplies industrial users with a trusted platform
for monitoring process control command flow and telemetry data,
enabling, among other things:•••

Detection of any command which would reconfigure a PLC
or change the PLC state.
Control parameter changes in technology processes.
Protection against outside threats while mitigating the riskof “advanced” insider interference from engineers, SCADA
operators or other internal staff with direct access to systems.

Machine Learning
Our industrial DPI can not only be configured by a standard rulebased approach – it can also detect anomalies inside industrial
processes via a powerful LSTM-based forecasting model.
Machine learning capability brings industrial anomaly detection
to a new level, making incident discovery possible in the mostcomplex and frequently reconfigured industrial networks.

Network integrity control for security
and assets inventory
KICS for Networks enables the identification of all Ethernet
connected network assets – including SCADA servers, HMIs,
engineering workstations, PLCs, IEDs and RTUs. All new or unknown
devices and their communications are detected automatically.
This gives security teams the capacity to develop their own reliable,
secure network asset inventory, rather than using potentiallyvulnerable OT/IT asset management tools which are highly targetedby attackers.

Forensic tools
Kaspersky’s solution gives industrial users a safe logging system,
which provides tools for data analysis and digital forensics. The
system also prevents any changes to ICS logs.

11Additional services
for Kaspersky Industrial
CyberSecurity
Kaspersky Security Network
Kaspersky Security Network (KSN) is a cloud-based, complex
distributed architecture dedicated to gathering and analyzing
security threat intelligence from millions of nodes worldwide. KSN
not only detects and blocks the newest threats and zero-day
attacks, but also helps locate and blacklist online attack sources,
providing reputational data for websites and applications.
All Kaspersky corporate solutions, including industrial solutions,can be connected to KSN if required. Key benefits include:••••

Superior detection rates.
Reduced reaction times – traditional signature-based
responses take hours: KSN responds in about 40 seconds.
Lower false positive rates.
Reduced resource consumption for on-premise security
solutions.

Kaspersky Private Security Network(KPSN)For organizations that have very specific data privacy concerns,
Kaspersky has developed the Kaspersky Private Security Network
option. It provides almost all the advantages of KSN, but without
sending any information whatsoever outside the network.
KPSN can be deployed within any organization’s own data
center, where in-house IT specialists retain complete control
over it. Local KPSN installations can help meet country-specificcompliance requirements or other industry-specific legislation.
Key KPSN functions:•••File and URL reputation services: MD5 hashes for files, regularexpressions for URLs and malware behavior patterns arecentrally stored, categorized and rapidly deployed to client
Record Management System (RMS): Sometimes security
software makes mistakes and incorrectly categorizes files or
URLs as trusted/not trusted. RMS acts as a “false positives”
deterrent, rectifying errors as well as continuously analyzing
to improve quality
Cloud-based intelligence and information.

12

Kaspersky Industrial CyberSecurity is a portfolio of technologies andservices designed to secure operational technology layers and elementsof your organization - including SCADA servers, HMIs, engineering
workstations, PLCs, network connections and even engineers - without
impacting on operational continuity and the consistency of industrial
process.
Learn more at www.kaspersky.com/ics

All about ICS cybersecurity:
https://ics-cert.kaspersky.com
Cyber Threats News:www.securelist.com***#Kaspersky#BringontheFuturewww.kaspersky.com© 2019 AO Kaspersky Lab. All rights reserved. Registered trademarks
and service marks are the property of their respective owners.

* World Leading Internet Scientific and Technological Achievement
Award at the 3rd World Internet Conference** C hina International Industry Fair (CIIF) 2016 special prize