Abstract: Approaches for automated and efficient detection of cybersecurity threats in operational technology (OT) environments are described. According to one example, operation data corresponding to an asset operating within an OT environment of an organization is obtained. The operation data is indicative of operating parameter values associated with the asset and a particular time at which the operating parameter values are obtained. Upon detecting an anomaly in at least one of the operating parameter values, information technology (IT) data corresponding to the organization is obtained for a pre-defined time window around the particular time. The IT data may include network access and activity logs associated with a communication network of the organization. Upon ascertaining a possibility of a cyberthreat event based on processing of the operation data and the IT data, an alert, including recommendation for preventing a cyberattack on the communication network, may be generated.

Abstract: Various embodiments described herein relate to providing spatially-efficient and comprehensive visualization of cyber-risk data associated with a plurality of assets. In one embodiment, a method is provided. The method includes accessing cyber-risk data associated with one or more particular assets of a plurality of assets. The method further includes determining whether the cyber-risk data for each particular asset satisfies one or more visual configuration thresholds, and in accordance with a determination that the cyber-risk data satisfies the thresholds, configuring one or more visual nodes of a hierarchical asset graph for the plurality of assets based at least in part on one or more asset groupings. The one or more visual nodes correspond to the particular assets and are configured to visually indicate the cyber-risk data that satisfies the visual configuration thresholds. The method further includes providing the hierarchical asset graph for display.

Abstract: A method, an electronic device, a computer readable medium is disclosed. The method includes modifying a header of an object to include a list of applications or files. The method also includes responsive to an application attempting to access the object, interrupting access to the object. The method further includes determining whether the application that is attempting to access the object is approved based on identifying at least one application or file included in the list of the modified header that corresponds to the application. The method also includes preventing the application from accessing the object when it is determined that the application is not included in the list of the modified header.

Abstract: A method, an electronic device, a computer readable medium is disclosed. The method includes modifying a header of an object to include a list of applications or files. The method also includes responsive to an application attempting to access the object, interrupting access to the object. The method further includes determining whether the application that is attempting to access the object is approved based on identifying at least one application or file included in the list of the modified header that corresponds to the application. The method also includes preventing the application from accessing the object when it is determined that the application is not included in the list of the modified header.

Abstract: This disclosure provides an apparatus and method for identifying and retrospecting cyber security threats, including but not limited to in industrial control systems and other systems. A method includes receiving, by a risk manager system, a selection of an asset for analysis. The method includes receiving, by the risk manager system, current and historical cyber-risk data corresponding to the asset. The method includes receiving a user selection of one or more data options for analysis of the asset. The method includes identifying relevant portions of the current and historical cyber-risk data according to the selected data options. The method includes producing an output corresponding to the selected asset, the selected data options, and the identified relevant portions of the current and historical cyber-risk data. The method includes displaying the output as a report in a graphical user interface.

Abstract: Various graphical displays used for visualization of control techniques in a process control system can be provided to an operator. For example, the graphical display could include an image associated with a portion of a process and icons that are associated with corresponding process variables. At least some of the icons include a symbol that represents a change of one value of the associated process variable relative to another value of the process variable. Another graphical display could include a pigeonhole display that includes visual elements associated with corresponding process variables. Selection of a visual element could present the operator with a peephole display that includes information associated with process variables associated with the selected visual element. Each visual element displays layers of information that are associated with its process variable.

Abstract: Various graphical displays used for visualization of control techniques in a process control system can be provided to an operator. For example, a graphical display could include (i) an image associated with at least a portion of a process and (ii) one or more icons identifying one or more process variables associated with at least the portion of the process. Selection of an icon could present the operator with a faceplate containing information associated with at least one of the process variables. Another graphical display could include (i) a focal variable symbol identifying a focal process variable and (ii) one or more additional variable symbols identifying one or more additional process variables associated with the focal process variable. Gains associated with the additional process variables could be identified in the display. Yet another graphical display could be used to remotely invoke and control applications executing in a process control system.

Abstract: Various graphical displays used for visualization of control techniques in a process control system can be provided to an operator. For example, the graphical display could include an image associated with a portion of a process and icons that are associated with corresponding process variables. At least some of the icons include a symbol that represents a change of one value of the associated process variable relative to another value of the process variable. Another graphical display could include a pigeonhole display that includes visual elements associated with corresponding process variables. Selection of a visual element could present the operator with a peephole display that includes information associated with process variables associated with the selected visual element. Each visual element displays layers of information that are associated with its process variable.

Abstract: Various graphical displays used for visualization of control techniques in a process control system can be provided to an operator. For example, a graphical display could include (i) an image associated with at least a portion of a process and (ii) one or more icons identifying one or more process variables associated with at least the portion of the process. Selection of an icon could present the operator with a faceplate containing information associated with at least one of the process variables. Another graphical display could include (i) a focal variable symbol identifying a focal process variable and (ii) one or more additional variable symbols identifying one or more additional process variables associated with the focal process variable. Gains associated with the additional process variables could be identified in the display. Yet another graphical display could be used to remotely invoke and control applications executing in a process control system.