KasperskyIndustrial
CyberSecurity:
solution overview

Kaspersky Industrial
CyberSecurity: solution overview
Introduction
Historically, industrial companies all over the world have approached cybersecurity
in their IT and OT (operational technology) networks differently. Most companies
already have mature breach detection and incident response measures in theircorporate infrastructure, but when it comes to OT they usually rely on a classical
air-gap approach. Industrial companies are becoming increasingly ‘digital’, investing
more and more in smart technologies, new automation systems, and the adoptionof Industry 4.0. That actually erases the gap between IT and OT environments thatis used to prevent cyberthreats from reaching industrial control systems. According
to Kaspersky ICS CERT, in the first half of 2019 the percentage of ICS computers on
which malicious objects were detected reached 41.2%1.

What are these threats?
First of all, they include the risk of accidental infection
by conventional malware. You don’t have to be a target tobecome a victim. A single ﬂash drive or phishing email witha banking Trojan or ransomware brought unintentionally intothe ICS environment can seriously affect the core businessof a company. Even if accidental infections do not occur thatoften, it is obvious that a motivated hacker can also penetrate
OT networks and cause considerable damage to expensive
equipment or production, or steal valuable information.

What are the proper ICS
cybersecurity measures?
1. Industrial endpoint protection to prevent accidental
infections and make motivated intrusion more difficult.
2. OT network monitoring and anomaly detection to identify
malicious actions on the level of programmable logiccontrollers (PLCs).
3. Training programs for employees to reduce accidents
and minimize the human factor.
4. Dedicated expert services to investigate the infrastructure,
conduct expert analytics or mitigate the impact of anincident.
1 Threat landscape for industrial automation systems, H1 2019, Kaspesky ICS CERT

1

What does Kaspersky provide?
Kaspersky addresses all the cybersecurity needs of industrial organizations in its
Kaspersky Industrial CyberSecurity (KICS) portfolio. KICS offers a holistic approach
to industrial cybersecurity, bringing value to any stage of the customer’s OT security
process – from cybersecurity assessments and training to advanced technologies
and incident response.

Kaspersky Industrial CyberSecurity components

Kaspersky Industrial CyberSecurity
PRODUCTSSERVICES

Industrial
Endpoint
Protection

Industrial
Anomaly andBreach Detection

CentralizedSecurity
Management

KICS for
Nodes

KICS for
Networks

KasperskySecurity
CenterTrainingand AwarenessExpert Servicesand Intelligence

In 2020, Kaspersky was mentioned in Gartner report“Competitive Landscape: Operational Technology Security”2
as a representative vendor in 4 product categories,
including:• OT Endpoint security;• OT Network Monitoring and Visibility;• Anomaly Detection, Incident Response and Reporting;• OT Security Services2.
Arc Advisory Group emphasizes that Kaspersky delivers
a unique combination of threat intelligence, machine learning,and human expertise that supports agile protection against
any kind of threat3.
Meanwhile, Forrester’s study4 shows an ROI of 368% for
a company using Kaspersky Industrial CyberSecurity as wellas other benefits such as expert support and peace of mind.
2 G artner: Competitive Landscape: Operational Technology Security, March 2020
https://ics.kaspersky.com/KICS-cited-in-Gartnercompetitive-landscape-OTsecurity
3 Arc Advisory: Kaspersky Moves Forward with Improved Cybersecurity Solutions, 2018
4 F orrester Research: The Total Economic Impact™ of Kaspersky Industrial CyberSecurity, April 2019.
https://www.kaspersky.com/ forrester-tei-for-kics

2

Products
KICS products are designed to comprehensively secure the industrial elements of yourorganization: KICS for Nodes is aimed at industrial endpoints, while KICS for Networks
monitors industrial network security.

Kaspersky Industrial CyberSecurity products deployment
Kaspersky software

Kaspersky software

Internet Internetffice Network
Office Network
Kaspersky
Security
CenterKaspersky
Security
CenterKaspersky
Security
CenterKaspersky
Security
Centernt DMZ Network
Plant DMZ Network

ADA/DCSSCADA/DCS
Network
NetworkKICS
for Nodes

KICS
KICS
forforNodes
Nodes

ntrol Network
Control Network

ldbus

KICS
for Nodes

SPAN
PLC

PLC

PLC

PLC

KICS for NetworksKICS for Networks
KICS for Nodes

Fieldbus

3

SPAN

KICS for Nodes

KICS for Networks
KICS for Networks is an OT network monitoring and visibility solution, delivered assoftware or a virtual appliance, passively connected to the ICS network.
The benefits:
9 Asset discovery
passive OT assetidentification and inventory

KICS for Networks detects anomalies and intrusions
inside ICS networks in their early stages and ensures thenecessary actions are taken to prevent any negative
impact on industrial processes.

9 Deep packet inspection
almost real-time analysis oftechnical process telemetry

KICS for Networks is an appliance-agnostic solution thatallows the customer to choose the industrial computing
appliance vendor they trust the most.

9 Network integrity control
detection of unauthorizednetwork hosts and flows

The KICS for Networks interface displays a live dashboard
and a network map, allowing working with assets andsecurity events.

9 Intrusion detection systemsends alerts about malicious
network activities

Example of KICS for Networks appliance

9 Command control
inspects commands overindustrial protocols
9 External systems
external detection
capabilities by API
integration

KICS for Networks interface

9 Machine learning for
anomaly detection (MLAD)
finds cyber or physicalanomalies through real-timetelemetry and historical
data mining (recurrentneural network)

4

KICS for Nodes
KICS for Nodes is an OT endpoint security product, delivered as software for Windowsand Linux-based machines.
The benefits:
9 Low impact on protected
device9 Highest compatibility
9 Advanced malware
protection

KICS for Nodes was specially designed to consume minimalresources. Built on security and embedded systems,
its modular architecture means you only have to install theprotective components you need. Protective components
can be configured to the threat prevention mode or todetection-only mode. This approach is ideal for legacy,
low-performance machines that require the maximum
available computing power.

9 Control of environment

KICS for Nodes functions and supported endpoints
Application Launch Control

Historianserver

Gateway

Anti -Malware

SCADA
serverDevice control
SCADA files integrity check
PLC integrity check

Industrial Endpoint
Protection

Anti -Cryptor
Exploit prevention
Log inspector

Operatorworkstation

KICS forNodes

Wi-Fi control
Firewall management“We decided to partner with
Kaspersky as Kaspersky
Industrial CyberSecurity
could be implemented whilst
our operations were stillrunning, and because thesolution is compatible withthe control systems we use”

Embeddedsystems

Systemmanagement
workstation

Engineering
workstation

KICS for Nodes secures industrial nodes from the varioustypes of cyberthreat that can result from human factors,generic malware, targeted attacks or sabotage. KICS forNodes is compatible with the software and hardware
components of industrial automation systems, such as
SCADA, PLC and DCS.

Jan Houben, Plant Manager,
AGC Glass Germany GmbH

5

Kaspersky Security Center
Kaspersky Security Center is a centralized security management solution. It provides
control and visibility of industrial layers at multiple sites as well as the surrounding
business networks.
The benefits:
9 Systems management• Centralized system datacollection• Centralized software
deployment• Vulnerability detection
and patch management• Extended client
management capabilities

9 Policy management• Centralized security policymanagement• Remote task schedulingand execution

9 SIEM integration• Arcsight, Splunk, Qradar• Syslog server

9 Reporting and notification• Event logging• Dashboards and reports• SMS/email notifications

9 MES dashboard integration• Security status andinformation delivery to IEC
104/OPC 2.0 compatible host

9 HMI integration

Kaspersky Industrial CyberSecurity:
services
Our suite of services forms an important part of the KICS portfolio – we provide the fullcycle of security services, from industrial cybersecurity assessment to incident response.

Expert services“Their experience in the ICS
cybersecurity domain,
professionalism and thecomplexity of their solution,in comparison with othersuppliers, has given us greatvalue and ensured a bright
future for our company’s
security strategy”• Industrial Cybersecurity Assessment: Kaspersky
provides a minimally invasive industrial cybersecurity
assessment, including external and internal penetration
testing, OT security assessment and automation
solution security assessment. Kaspersky experts provide
significant insights into a company’s infrastructure andgive recommendations on how to strengthen the ICS
cybersecurity posture.

Ondřej Sýkora, C&A manager,Plzeňský Prazdroj• Threat Intelligence: Up-to-date analytics collected byKaspersky experts help enhance the customer’s protection
from targeted industrial cyberattacks. Provided as TI
feeds or tailored reports, they meet specific customer
needs according to regional, industry and ICS softwareparameters.

6

“By undertaking theexercise and learningfrom the Kaspersky team’s
knowledge, we haveincreased our protection
against cyber securitythreats”
Yu Tat Ming, CEO,PacificLight.

• Incident Response: In the event of a cybersecurity
incident, our experts will collect and analyze data,
reconstruct the incident timeline, determine possible
sources and motivation, and develop a remediation plan. In
addition, Kaspersky offers a malware analysis service
in which Kaspersky experts will categorize any malware
sample provided, analyze its functions and behavior, anddevelop recommendations and a plan for its removal fromyour systems and for rolling back any malicious actions.

Training and awareness“Kaspersky was the best
possible company to deliverprofessional industrial
cybersecurity skills training
for our ICS group”
Søren Egede Knudsen,
Chief Technical Officer,
Ezenta• Industrial Cybersecurity awareness training: On-siteand online interactive training modules and cybersafety
games for employees interacting with industrial
computerized systems and their managers. Participants
gain a new insight into the current threat landscape andattack vectors specifically targeting the industrial
environment, explore practical scenarios and acquire
cybersafe working skills. The on-site course can becustomized and adapted to run over one or two days.
• Expert training programs: The ICS Penetration Testingand ICS Digital Forensics training modules were createdfor cybersecurity professionals. Participants gain all
the advanced skills needed to conduct comprehensive
pentests or digital forensics in industrial environments.
Certification included.

Learn more about KICS at
https://ics.kaspersky.com***#Kaspersky#BringontheFuturewww.kaspersky.com© 2020 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are
the property of their respective owners.

* World Leading Internet Scientific and Technological Achievement Award at the 3rd World InternetConference** C hina International Industry Fair (CIIF) 2016 special prize