Abstract: A protection system, method, and a security device can protect an operational technology (OT) system having connected hardware equipment, including at least an interface that can receive a control communication and an industrial control device (ICD) for controlling at least one industrial device. They feature tasks/steps that receive control communication from the communication interface, determine whether the received control communication contains an undesirable control command, and either pass or block the received control communication to the ICD depending on whether the received control communication contains an undesirable control command. The security device can be disposed between a source of communication in an OT network and the ICD for protection.

Abstract: A protection system, method, and a security device can protect an operational technology (OT) system having connected hardware equipment, including at least an interface that can receive a control communication and an industrial control device (ICD) for controlling at least one industrial device. They feature tasks/steps that receive control communication from the communication interface, determine whether the received control communication contains an undesirable control command, and either pass or block the received control communication to the ICD depending on whether the received control communication contains an undesirable control command. The security device can be disposed between a source of communication in an OT network and the ICD for protection.

Abstract: A protection system, method, and a security device can protect an Internet of things (IOT) system having connected hardware equipment, including at least an interface that can receive a control communication for controlling at least one connected device. They feature tasks/steps that intercept control communication between a controller and a connected device, determine whether the received control communication contains an undesirable control command, and either pass or block the received control communication to the connected device depending on whether the received control communication contains an undesirable control command. The security device can be disposed between a source of communication in an IOT network and the connected device for protection.

Abstract: A protection system, method, and a security device can protect an Internet of things (IOT) system having connected hardware equipment, including at least an interface that can receive a control communication for controlling at least one connected device. They feature tasks/steps that intercept control communication between a controller and a connected device, determine whether the received control communication contains an undesirable control command, and either pass or block the received control communication to the connected device depending on whether the received control communication contains an undesirable control command. The security device can be disposed between a source of communication in an IOT network and the connected device for protection.

Abstract: A protection system, method, and a security device can protect an operational technology (OT) system having connected hardware equipment, including at least an interface that can receive a control communication and an industrial control device (ICD) for controlling at least one industrial device. They feature tasks/steps that receive control communication from the communication interface, determine whether the received control communication contains an undesirable control command, and either pass or block the received control communication to the ICD depending on whether the received control communication contains an undesirable control command. The security device can be disposed between a source of communication in an OT network and the ICD for protection.

Abstract: An overlay cyber security networked system and method that includes one or more devices configured to monitor physical-level signal information to determine a cyber security threat or breach event based on activity occurring with physical signals present at one or more components of a Process Control Network (PCN), enabling forensic analysis. The overlay cyber security networked system also provides information needed for real-time incident management by capturing logs of relevant events at various points in the network hierarchy starting at the analog signaling from the sensors to detect unauthorized variances in operational parameters, thereby providing a defense in depth security architecture for PCN-based systems.

Abstract: A cyber signal isolator system and a cyber signal isolator method for protecting a component of an Industrial Control System are described. The cyber signal isolator system includes one or more devices configured to monitor physical-level signal information to determine a cyber security threat or breach event based on activity occurring with physical signals present at one or more components of an Industrial Control System.

Abstract: System and techniques for cyber-physical system defense are described herein. Sensor disagreements between a plurality of sensors over time can be sampled. Cluster analysis on the sampled sensor disagreements can be performed. A deviation indication can be provided in response to the cluster analysis resulting in disagreement density beyond a threshold.

Abstract: System and techniques for cyber-physical system defense are described herein. Sensor disagreements between a plurality of sensors over time can be sampled. Cluster analysis on the sampled sensor disagreements can be performed. A deviation indication can be provided in response to the cluster analysis resulting in disagreement density beyond a threshold.

Abstract: A cyber security system and method that includes one or more devices configured to determine a cyber security threat or breach event based on analysis of operational information of a protected system.

Abstract: A cyber security system and method that includes one or more devices configured to determine a cyber security threat or breach event based on analysis of operational information of a protected system.