Abstract: A method for transmitting secured Ethernet frames on a communication line, the method including the following in a transmitter module: receiving an Ethernet frame comprising payload data from a network layer retrieving a secure policy, defining the type of security to be applied to the Ethernet frame; producing an initialization vector based on an encryption counter and a physical address of the transmitter module; creating an authentication tag by applying an authentication algorithm on the secure policy, the initialization vector and the payload data using a shared key and the initialization vector; adding the secure policy, the initialization vector and the authentication tag to the payload data to create a secured Ethernet frame; and sending the secured Ethernet frame to a data link layer for transmission on the communication line.

Abstract: Systems and methods of providing industrial system cybersecurity event detection and corresponding response are described. The systems and methods utilize various end point sensors already available in an industrial control system and an associated monitoring process to detect cybersecurity and other security threats based on data collected by the sensors. The cybersecurity monitoring process may be trained with sensor data patterns and behaviors for known threats to recognize potentially malicious activity. Such a process may also learn to recognize and be trained on new threats and may incorporate each new threat to stay current with evolving industrial threats. This allows an enterprise to utilize its existing industrial infrastructure to detect and act upon a variety of threats to an industrial system with little or no interference or interruption of existing industrial processes.

Abstract: Systems and methods of providing industrial system cybersecurity event detection and corresponding response are described. The systems and methods utilize various end point sensors already available in an industrial control system and an associated monitoring process to detect cybersecurity and other security threats based on data collected by the sensors. The cybersecurity monitoring process may be trained with sensor data patterns and behaviors for known threats to recognize potentially malicious activity. Such a process may also learn to recognize and be trained on new threats and may incorporate each new threat to stay current with evolving industrial threats. This allows an enterprise to utilize its existing industrial infrastructure to detect and act upon a variety of threats to an industrial system with little or no interference or interruption of existing industrial processes.

Abstract: A security system for an industrial control system that includes one or more hardware entities and/or one or more software entities accessible by at least one user via at least one security portal, the security system including: a security database: and a security server. Each hardware or software entity includes a software agent including: a module for verifying each security token received coming from a security portal or from a hardware or software entity, a module for analyzing access rights of the user, of another software entity or hardware entity, and a module receiving security tokens configured to transfer a token to a second hardware or software entity to which a security portal or another entity wishes to gain access.