Manufacturing Solution Brief 2022

Manufacturing
Cybersecurity andrisk management for
digital transformation“Forescout is invaluablefor identifying,consolidating andsegmenting assets as
we continue to growby acquisition.”

Today, manufacturers rely on flexible, built-to-order production
methodologies that improve efficiency, reduce errors and cut costs –but also introduce greater cyber risk through the convergence of OT, ITand IoT networks. Unwanted communication links often go unchecked
and vulnerabilities hide in plain sight based on the assumption thatOT and IT are separated when they are not. Ransomware attacks
make headlines, but day-to-day network or process misconfigurations,operational errors, resource usage spikes and other anomalies are
far more likely to threaten productivity than outside attacks.

— CISO, Fortune 500
Manufacturing Company

Managing exponential OT/IoT asset growth amid a shortage ofspecialized cybersecurity talent presents many challenges for OT
asset owners and security teams. Two of the most difficult are:▶

Visibility into assets, their connectivity within and beyond the OT
networks and what cybersecurity and operational risk this creates▶

Ability to detect any threat to operational continuity and prioritize
response across geographically dispersed plants to reduce downtime

With industrial environments increasingly dependent on digitalsystems for production, automated cybersecurity is essential.
Organizations need a continuous, automated approach to asset
discovery, assessment and governance to ensure proactive risk
management and security compliance – so you can detect cyberthreats before they lead to operational or security incidents.

1

Manufacturing Solution Brief 2022

Forescout Continuum Platformfor Manufacturers
Forescout excels
in ICS asset
visibility
Forescout has “the broadest
ICS protocol support of thevendors evaluated” according
to the Forrester Wave™:
Industrial Control Systems(ICS) Security Solutions, Q4
2021. This extensive protocol
knowledge, coupled with ICSspecific threat intelligenceand 12+ years of experience
deploying our OT solutions
to various manufacturing
verticals, enables industrialorganizations around theglobe to secure their digitaltransformation and lay
the foundation for a zerotrust architecture acrosstheir entire digital terrain,including critical OT and IoT
devices and networks.

Forescout Continuum provides the continuous, automated asset
management, risk compliance and remediation, non-intrusive OT/ICS network monitoring, network access control, segmentation andsecurity orchestration you need to protect your digital terrain from awide range of threats. The platform combines patented deep packet
inspection (DPI) and anomaly detection technology specificallydesigned for OT/ICS and IoT environments with a library of thousandsof ICS-specific threat checks and indicators of compromise (IOCs) foradvanced cyberattacks, network misconfigurations and operational
errors so you can detect both known and unknown threats.
Real-time network maps, visualizations and in-depth traffic analysis
offer complete visibility into asset configurations, communication
behavior and the changing threat landscape, so any cybersecurity andoperational risks are known and any threat to operational continuity
is detected, prioritized and remediated. The cybersecurity platform
enables manufacturers to act on identified risks and automate responses
actions, from modest to stringent, to protect vulnerable, high-risk andcompromised devices while keeping mission critical assets online.

Achieve real-time network visibility
Forescout Continuum provides a real-time asset inventory for the entire ICS
network and beyond using passive, active or hybrid asset discovery options
for identifying and assessing any type of device connected to the network– from decade-old process controllers to dormant IT systems and new
IoT devices – driving compliance automation and efficiency. DPI passively
discovers details including network address, host name, vendor and model,
serial number, OS or firmware version, hardware version and backplane
module information, while non-intrusively identifying OT/ICS vulnerabilities.
The platform provides visibility down to serial devices, such as I/O
modules at Purdue level 0, logging configuration and behavioral changes
for security analysis and operational forensics. It automatically builds a
detailed and interactive network map with extensive device information,baselines for each asset, communication visualizations and groupingsby network, role, Purdue level and communication relationship.
Integration with the security ecosystem and bi-directional workflow
automation allows any asset to be identified upon connect, while our
optional active discovery technology for OT/ICS networks securely
and selectively queries specific endpoints on the network, including
industrial controllers, to get a complete inventory of all connectedassets quickly and effectively. For Windows, Linux and Mac endpoints,
patch levels and compliance status can be verified automatically against
common or customer-specific security policies and best practices.

2Manufacturing Solution Brief 2022

Identify cybersecurity and operationalrisks to reduce downtime
Forescout provides a unique Asset Risk Framework that continuously
calculates an impact-based risk score for each asset, considering both acybersecurity risk score (for SOC teams) and an operational risk score(for OT operators). The scores are continuously evaluated using detected
events associated with the asset, proximity to other potentially infectedassets, communication links and behavior, known vulnerabilities and otherdetails. This provides the most relevant and up-to-date risk assessmentthat can be used to make more informed decisions when mitigating
risks and other activities. Typical security risks identified include:

▶
▶
▶
▶
▶
▶
▶
▶

Use of default credentials and insecure authentications and protocols
New and non-responsive assets
Poor segmentation exposing vulnerable devices to the internet
Suspicious user behavior/policy changes
Malformed messages including those used in exploit attempts
Unauthorized network connections and communications
Malware infections and malware spread
Cyberattacks (DDoS, data exfiltration, MITM & scanning, etc.)

Occasional networking and operational issues are inevitable, but theyneedn’t result in significant downtime. The operational risk analysis
enables OT engineers to quickly spot urgent issues including:

▶
▶
▶
▶

Failure of critical devices▶

Unauthorized PLC logic and firmware changes

Unstable process values
Incorrect process measurements
Devices exhibiting signs of misconfiguration or malfunctionthat could cause unexpected downtime

Forescout Continuum combines signatures with behavioral andpatented anomaly detection techniques to detect known and unknown
security and operational threats from the earliest stage (discovery)
through the actual exploit. An interactive map identifies the sourceand spread of an incident, and the data provided in its packet captures(PCAPs) supports root cause analysis to expedite response efforts.
3Manufacturing Solution Brief 2022

Manage the exponential growth of connectedassets and changing threat landscape

Actionable
Research fromVedere Labs
Staying ahead of bad actors
requires relentless diligence.
The Forescout Device Cloud isthe world’s largest cyber asset
repository, with anonymized
data collected and monitoredfrom millions of deployed IT,
IoT, IoMT and OT devices. This
intelligence is plowed into ourplatform to supply the mostaccurate asset auto-classificationand threat detection available.

The threat landscape is evolving fast, so security teams need
to be able to quickly identify new assets, assess their risks andmanage any threats with pro-active mitigation and automatedremediation. With Forescout Continuum you can:▶

Visualize communications and automatically optimize
segmentation so vulnerable devices continue operating
securely as interconnectivity increases or changes.

▶

Automatically verify the security and compliance postureof every asset, including third-party or contractor
devices, before granting them access to the network andspecific assets to perfom maintenance operations▶

Optimize threat analysis and remediation with ICS-specific threat
intelligence, multi-dimensional alert aggregation and MITRE ATT&CK
for ICS classification to enable efficient incident response.

Vedere Labs, Forescout’s threat
intelligence and research teamalso leverages the Device Cloudfor advanced intelligenceto alert customers and thebroader security community
about emerging risks andsupply mitigation steps throughthreat briefings, vulnerability
disclosures and demonstrations
including Project Memoria,
R4IoT and OT:ICEFALL.

4Manufacturing Solution Brief 2022

Forescout OT Deployment Model
This diagram shows a typical deployment architecture of the Forescout
solution for industrial plants and manufacturing deployments.
Various sensor deployment options are available, ranging from highperformance appliances for centralized deployments to ruggedized
and lighter low-cost models as well as deployment on existing network
infrastructure equipment for use in decentralized or segmented
networks with limited throughput. Further integrations with thesecurity ecosystem to exchange insights, automate workflows
and initiate response to emerging cyber threats are available.

Figure 1: Typical deployment architecture for manufacturing environments combines passive network monitoring with active discovery and integrations toautomate cyber security across the OT/ICS environment and beyond.

Forescout Technologies, Inc.

©2022 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,

Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Inc. is a Delaware corporation. A list of our trademarks and patents is available at
Other brands, products, or service names may be trademarks or service marks ofLearn more at Forescout.com

their respective owners. Version 01_02

www.forescout.com/company/legal/intellectual-property-patents-trademarks.

5