Microsoft announced today that Azure Defender for IoT, its agentless security solution for networked IoT and Operational Technology (OT) devices, has entered public preview.
Azure Defender for IoT is an IoT/OT device threat protection solution that integrates with Microsoft’s Azure Sentinel and third-party solutions (SIEMs, CMDBs, and SOAR) to provide continuous threat monitoring and vulnerability management.
It focuses on providing security monitoring for specialized device types, applications, and machine-to-machine (M2M), as well as specialized industrial protocols (Modbus, DNP3, BACnet, etc.) within IoT/OT environments.
By adding visibility into misconfigured, unmanaged, and unpatched IoT/OT devices, it makes it a lot harder for threat actors to abuse them to gain a foothold into the networks of industrial and critical infrastructure organizations.
“You can deploy these capabilities fully on-premises without sending any data to Azure,” Phil Neray, Director of Azure IoT Security Strategy, explained.
“Or, you can deploy in Azure-connected environments using our new native connector to integrate IoT/OT alerts into Azure Sentinel, benefiting from the scalability and cost benefits of the industry’s first cloud-native SIEM/SOAR platform.”
The alerts sent by Azure Defender for IoT into Azure Sentinel are triggered by analytics detection engines for protocol violation, policy violation, industrial malware detection, anomaly detection, and operational incident detection included on sensors used to collect ICS network traffic.
These alerts are “based on analysis of both real-time and pre-recorded traffic” and they cover a wide range of incidents including but not limited to:
- Unauthorized device connected to the network
- Unauthorized connection to the internet
- Unauthorized remote access
- Network scanning operation detected
- Unauthorized PLC programming
- Changes to firmware versions
- “PLC Stop” and other potentially malicious commands
- Device is suspected of being disconnected
- Ethernet/IP CIP service request failure
- BACnet operation failed
- Illegal DNP3 operation
- Master-slave authentication error
- Known malware detected (e.g., WannaCry, EternalBlue)
- Unauthorized SMB login
“In addition, you can create custom alerts based on your knowledge of expected device behavior,” according to Microsoft. “An alert acts as an indicator of potential compromise, and should be investigated and remediated.”