Abstract: Embodiments of the disclosure provide improvements for managing access of nodes, including wireless nodes, to a network including operational technology device(s) (e.g., a wireless OT network). Some embodiments include detecting a node from at least one message communication over a wireless OT network, authenticating node identification information that uniquely identifies the node, confirming that the node is permissioned to access the wireless OT network by at least validating authentication information associated with the node, confirming that the node is attempting an authorized action by at least validating authorization information associated with the at least one message communication, and assigning an access indicator based at least in part on the authenticating of the node identification information, the validating of the authentication information, and the validating of the authorization information.

Abstract: Embodiments of the present disclosure provide for improved methodologies for managing initiation of an automated healing process for operational technology devices in a network. Some embodiments include identifying at least one operational technology (OT) device connected to a network that is vulnerable to at least one cybersecurity risk, where the at least one OT device is wirelessly connected to the network, identifying at least one computer-executable resolution to the at least one cybersecurity risk, executing a simulation that tests performance of the network with resolution of the at least one cybersecurity risk utilizing the at least one computer-executable resolution, generating a solution implementation report based at least in part on the simulation, and determining whether to automatically initiate the at least one computer-executable resolution based at least in part on the solution implementation report.

Abstract: In various embodiments, network traffic data associated with an industrial network is monitored based on a networking event rule set related to defined networking events. The network traffic data is related to a set of asset devices in communication via the industrial network, and the networking event rule set is used to determine a networking event associated with the set of asset devices. A cybersecurity event level for the networking event is determined based on a comparison between a networking event feature set for the networking event and a predefined cybersecurity event feature set for a set of predefined cybersecurity events. In response to a determination that the cybersecurity event level for the networking event satisfies a predefined cybersecurity threat level threshold, a modification is made to one or more configuration parameters for one or more asset devices from the set of asset devices associated with the networking event.

Abstract: Various embodiments described herein relate to an asset discovery engine with a deep vulnerabilities scanner with respect to assets in an industrial network. In an embodiment, a request to perform an asset vulnerability assessment of one or more assets within a network is received, the request comprising an asset descriptor describing the one or more assets. In response to the request, aggregated asset property data associated with the one or more assets is obtained based on the asset descriptor. Furthermore, the asset vulnerability assessment is performed based on the aggregated asset property data and asset vulnerability signature data stored in an asset vulnerability signature repository. In response to determining that the asset vulnerability assessment satisfies a defined criterion, one or more actions associated with the network are performed.

Abstract: There is a need for more effective and efficient network security coordination. This need can be addressed by, for example, techniques for network asset vulnerability detection. In one example, a method includes detecting network assets within a monitored computer network; and for each network asset: determining a vulnerability profile, determining a connectivity profile, determining a vulnerability designation based on the vulnerability profile for the network asset and a network vulnerability documentation repository, determining whether the vulnerability designation for the network asset indicates a positive vulnerability designation, and in response to determining that the vulnerability designation indicates the positive vulnerability designation, decoupling the network asset from the monitored computer network using the connectivity profile for the network asset.

Abstract: A method of cybersecurity performance analyzing for customer site(s) including assets in a networked system including different asset types, and a virtual security engine (VSE) server. The customer site is coupled to a Security Center (SC) including a SC server, and a cybersecurity hardening compliance engine (CHCE). The VSE server collects identification data and security configuration data from the asset types, and transfers the data to a SC database. Responsive to a user request to generate a cybersecurity hardening compliance report, the CHCE sends a query to the SC database to retrieve at least a portion of the data, uploads a cybersecurity benchmark including cybersecurity configuration rules (CCRs) for least a selected asset type, compares the data of the assets to the CCRs, and generates from results of the comparing a cybersecurity report including a quantitative measure of cybersecurity performance for the assets of the selected asset type.

Abstract: There is a need for more effective and efficient network security coordination. This need can be addressed by, for example, techniques for network asset vulnerability detection. In one example, a method includes detecting network assets within a monitored computer network; and for each network asset: determining a vulnerability profile, determining a connectivity profile, determining a vulnerability designation based on the vulnerability profile for the network asset and a network vulnerability documentation repository, determining whether the vulnerability designation for the network asset indicates a positive vulnerability designation, and in response to determining that the vulnerability designation indicates the positive vulnerability designation, decoupling the network asset from the monitored computer network using the connectivity profile for the network asset.