On Tuesday March 9th, Bloomberg reported that threat actors had breached security camera feeds by Verkada Inc, a Silicon Valley startup, gaining access to almost 150,000 video surveillance cameras inside hospitals, organizations, police departments, prisons and schools. This was an unsophisticated hack, i.e the threat actors found exposed credentials for an administrator’s account on the Internet.

While many security vendors are claiming that they could have detected the breach, note that in this specific case the credentials used were valid administrative credentials that provided access to multiple feeds from multiple customers in the Verkada cloud servers and not customer networks. Additionally, because of Verkada’s architecture, every feed from an organization’s cameras was encrypted and sent directly to the cloud. Therefore, any on-premises security solution would not have detected any anomalies from the cameras as they were simply streaming video to the centralized cloud server.

However, there are several security learnings from this incident:

• Real-time visibility is critical – Video surveillance cameras are pervasive, and just like many IoT devices, are not built with security in mind. Security starts with knowing what’s on your network. Our customers use our inventory dashboard to find devices like Verkada or any other video surveillance cameras in their network.

• Profile risks and behavior– It’s important to not only identify devices, but also understand the risks they bring and map how they communicate. In one Ordr deployment, we found that 60% of an organization’s cameras deployed in hundreds of facilities world-wide were using default passwords that were published on the Internet. And some of these cameras were running “non-production” software, calling home to their R&D center in China periodically. Once you understand risks and baseline normal communications, you can create segmentation policies to enable devices access required for its role while limiting exposure.
• Monitor admins, users and access – Always make sure that admin maintenance accounts are secured properly, and monitor users and access. As outlined in this blog, Ordr provides very robust tracking of users using AD/RADIUS and wireless integration, so you can monitor which user is accessing what devices at what time. We also monitor supervisory protocols SSH, Telnet, RDP, and can monitor access by corporate versus guest users.

Organizations must look at the rapid growth of connected devices (ie. digital transformation) as an opportunity to start maintaining a continuous and accurate inventory, a true understanding of how those devices communicate, automate alerts based on any device or group of devices that act outside of a set baseline, and automate proper segmentation of devices as to not let lateral movement inside your network via the device(s).

Paradigmatic shifts are often not fully recognized until after they have occurred. Innovations are made, evolutions take place, and then someone realizes, “Hey, this is much different from when it started.” That’s when people start to re-think context and terminologies reflective of the new reality.

Cyber-Physical Systems: A Brief History

That scenario is playing out in the realm of the Internet of Things (IoT) and its permutations like the Internet of Medical Things (IoMT), Industrial Internet of Things (IIoT), Internet of X Things (IoXT) that covers consumer, military, automotive, and other applications of connected technologies, and operational technology (OT). It’s a trend that began back in the 1980s when system-on-chip technology started getting designed into office printers, then adapted to use for industrial equipment, allowing users to manage and monitor machines and office appliances via the organization’s local area network (LAN). When the LAN gave way to public networks, the term “Internet of Things” was coined by MIT’s Kevin Ashton during a proposal to Procter & Gamble in which he suggested using RFID tags to track products moving through the supply chain.

Fast-forward to 2006 when, according to the National Institutes of Health’s National Library of Medicine, the term cyber-physical systems was introduced to describe the interplay of digital and analog infrastructure in which “embedded computers monitor and control physical processes, usually with feedback loops, where physical processes affect computations and vice versa.”

Gartner has since adopted the term cyber-physical systems (CPS) to describe the full scope of connected technologies that once seemed arcane but are now not only common, but integral to the digital operations and infrastructure of nearly every enterprise. CPS are therefore the next-generation of integrated physical and cyber systems, and can include IoT, OT, and IoMT assets such as critical infrastructure sensors, surveillance cameras, building management systems, and healthcare devices with embedded systems that interact with the real world as well as with complex software elements. And because of the essential role CPS now plays, the devices comprising CPS assets have introduced new, critical risks to the organizations that have adopted them as a part of their digital transformations.

Managing Risks With Cyber-Physical Systems

That means new challenges for the IT security teams responsible for keeping networks, data, and people safe. In a recent report, Innovation Insight for Cyber-Physical Systems Protection Platforms, Gartner wrote:

“As organizations connect operational or mission-critical systems, or deploy automation and digital transformation technology, they create cyber-physical systems that security and risk management leaders must securely manage. Enter CPS protection platforms — new solutions for a new security reality.”

A cyber-physical systems protection platform is a security solution that automates cyber-physical systems asset discovery, and adds a range of security-related features to improve the risk posture of CPS. Gartner believes that by 2025, “70% of companies will deploy cyber-physical systems protection platforms as the first step in their asset-centric security journey.” As described in the Gartner graphic below, when organizations embrace digital transformation and IT/OT convergence, they will need to move towards an asset-centric view of security.

The Gartner report outlines findings, challenges, and recommendations for organizations confronting their CPS security realities for the first time, describes the risks that unprepared and ill-equipped enterprises face, and requirements for CyberPhysical Protection platforms.

Ordr Addresses Visibility and Security of Cyber-Physical Systems

Fortunately, Ordr offers a CPS protection platform that addresses these risks and makes it easy for organizations to see, know, and secure the devices that have been accruing to their enterprise inventories over the years (as well as those ones they didn’t know were connecting and operating on their infrastructure) — including IT, IoT, and OT. In fact, Ordr is named by Gartner as one of the leading CPS protection platform innovators, focused on addressing the unique, asset-centric approach required to protect connected devices and their infrastructures.

Ordr was engineered for the CPS environment, and delivers many security benefits specific to protecting cyber-physical systems, including:

• Automated asset discovery and classification to gain an accurate view of your CPS attack surface.
• Identification of vulnerable devices, malicious communications, and active threats to uncover previously unknown risks.
• Prioritized remediation and mitigation efforts with risk scores calculated for every asset.
• Accelerated incident response with dynamically created policy to stop malicious communications and protect devices.
• Improved security with automated policy for NAC and Zero Trust segmentation.

Learn more about the Ordr platform and how we can help you protect your CPS assets, get in touch with us directly.

Chris Westphal

Head of Product Marketing

Chris is the Head of Product Marketing at Ordr where he helps drive awareness for connected device security and the value of the Ordr solution. Chris brings more than two decades of experience to his role with a background in enterprise security, cloud, and data center technologies. Most recently, Chris was head of product marketing at Salt Security, the leader in API protection, and has held product marketing leadership roles at companies including VMware, Illumio, and Adallom (acquired by Microsoft).

This week SolarWinds announced that they were breached earlier this year and the attackers were able to place malicious code within their build systems for their Orion product. This malicious code was subsequently; compiled, tested, signed, and delivered to SolarWinds customers in March 2020. The last week has been very interesting as a supply chain breach of this magnitude has only been theorized and discussed in security tabletop exercises. After the SolarWinds breach announcement we have been working with several Ordr customers and partners in order to facilitate both detection of malicious activity associated with this breach and for some customers facilitate the detection of these SolarWinds devices on the network so that they could be taken down.

Currently, Ordr has the ability to detect the command and control (C2) servers utilized in the Domain Generation Algorithm (DGA) of this SolarWinds malware through our malicious communication detection service. Ordr monitors all device communications within the network and if we see a connection or DNS lookup to one of the malicious domains associated with this malware (*.avsvmcloud.com – as part of the countermeasures by FireEye) we will alert the Ordr SCE operators.

Additionally, we have deployed several detection signatures to our deep packet inspection (DPI) intrusion detection system (IDS) that looks for both the malicious communications associated with this SolarWinds malware and the lateral movement techniques that FireEye and Microsoft discovered when researching the threat actors utilizing the SolarWinds malware.

Of course, since Ordr has the capability to detect and classify all systems on the network we are able to detect any SolarWinds systems that exist at any time on the network.

SolarWinds has provided a hotfix (2020.2 HF 1) and is providing an additional hotfix (2020.2 HF 2) today to all of their customers. We urge all SolarWinds customers to apply these patches to their systems and to aggressively monitor the SolarWinds servers for any anomalies.

Additionally, we are urging anyone that utilizes SolarWinds Orion to change any authentication credentials that were stored inside the Orion system and to consider all authentication credentials compromised if they were stored inside the Orion system within the last 10 months.

The world seems upside down at the moment, and it is difficult not to be anxious and stressed. There were times in my past when during stressful moments, I would take a welcomed trip to the Bronx Zoo.  The escape from the hustle and noise of the city was a welcome reprieve. I quite enjoyed the simplicity of a walk to visit the animals and wildlife. My personal favorite was the rhinos, healthy and fit yet calm and proud.

Keeping the Animals Separate

When you enter the Bronx Zoo in New York City, you will notice that the animals are separate in particular areas. At the southern end of the park, there is the African Plains section with the giraffes and wild dogs, and it’s also where you can see the fierce lions basking in the sun. Over by the Himalayan highlands is where visitors can observe the snow leopard and the red panda.  So awesome those little red pandas. Between the mountains and the plains, you will find playful characters in the baboon reserve.

There is, of course, a separate world of reptiles, the birds of prey, even Madagascar! Where ring-tailed lemurs roam playfully. At the north section of the zoo by the fountain, the circle is the aquatic birdhouse, the sea bird aviary and the birds of prey.  To the east of the main foundation at the Fordham Road gate is where you whisk away to the high plains and see the Bison grazing. Everything in the animal kingdom in its place, everything in order.

Covering over 265 acres, the Bronx zoo is one of the largest in the US and first opened its doors in 1899. Sections and regions are well organized, and every animal, reptile, bird, you name it, is grouped logically together: kingdom, phylum, class, order, family, genus, and species. The ordering makes sense, everything is in their natural habitat, and you won’t find an antelope sharing a snack with the penguins. The order of things is intuitive, and the segmentation implemented adds a layer of protection.

Segmentation Keeps Threats at Bay

Segmentation can also help mitigate risk. At the zoo, you can have external threats, bad actors coming from the outside, and causing damage and internal risk when you can have havoc from the inside. In 2001, an otherwise normal man climbed a 20-foot wall entered the gorilla enclosure, and stripped down to his boxer shorts, telling the NYPD later that he wanted to be “one with the gorillas.” In 2007 Javan langurs (an old-world monkey form the colobinae subfamily) was placed together with Oriental small-clawed otters. The monkeys proceeded with well, monkey business, and it didn’t end well for one of them, a tragic example of internal risk.

Likewise, there are external and internal risks that large enterprises deal with every day. From hospitals to banks to retail operations, information is valuable, and hackers will do anything to attack from the outside to get access to valuable information.  An example of internal risk is when compromised employees or vendors go after sensitive information, or if an employee unknowingly grants access to an attacker by clicking on a phishing link in an email.

Similar to the order of things at the zoo, we help organizations segment their networks in a manner that makes sense. We can divide networks granularly down to the workload level and define specific security policies for these specific segments and workloads. So instead of just using gates and fences seen at some local animal farm, it’s a more secure process where movement can be monitored, communications can be traced, and all the animals can roam but stay in their respective regions.

If and when a deviation occurs (a crocodile gets out, or a device in the ER room talks to the finance department), our system can take remedial action right away. If a green peafowl escapes, there is no need to close the entire zoo. Our system is smart enough to contain the bird in the right area.

Segmentation Keeps Red Pandas and Networks Safe

With Ordr, we can help reduce the number of alerts and alarms and act fast when something unexpected happens. We proactively protect the enterprise network, and traffic is analyzed at multiple layers. Our SCE system creates a conversation map called the flow genome for every connected device. We can identify all communications between the various segment and VLANs, and we leverage AI to baseline normal communication behavior and then translates these behaviors into a device-specific security policy. The red panda will be proud.  

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

SANTA CLARA, Calif., Oct. 12, 2021 /PRNewswire/ — Ordr, the leader in agentless security for all connected devices, today announced the appointment of René Bonvanie as Executive Chairman to the company’s board of directors. A 35-year executive leader, René brings a wealth of operational and go-to-market experience, providing strategic counsel and guidance to Ordr’s leadership team. He currently serves as an Executive in Residence at Battery Ventures and previously worked for over ten years as Chief Marketing Officer of Palo Alto Networks. Dominic Orr, Ordr’s Executive Chairman of the Board since 2019, will remain on the company’s Board of Directors and continue working closely with the senior management team.

“René’s deep expertise in the cybersecurity market, his intimate familiarity with customer needs, and his understanding of Ordr through his work with Battery Ventures are an ideal fit as we continue to grow rapidly,” said Greg Murphy, CEO of Ordr. “We are delighted to have a world-class executive of René’s caliber joining the Board and working closely with our leadership team to deliver the greatest possible value to our customers.”

As CMO of Palo Alto Networks, René grew the company from startup through an initial public offering, and then scaled it to become one of the leading cybersecurity vendors in the world with nearly $3 billion in annual revenue. He also served in senior executive roles at a variety of companies including Ingres, Oracle, Business Objects, SAP, and Salesforce.

The Executive Chairman appointment follows a record-breaking quarter for Ordr, with 125%+ year over year growth in new annual recurring revenue (ARR) and record total bookings. The accelerating growth was fueled by market demand for connected device security across verticals, including healthcare and industrial.

“René joins us at a pivotal point in Ordr’s journey and in the industry. With the alarming increase in cybercrime, organizations are looking not only for visibility and insights on connected devices, but a complete set of security features to protect and respond to cyberattacks. Ordr is well positioned to meet these needs, and René’s experience will be invaluable in accelerating our growth,” said Pandian Gnanaprakasam, founder and Chief Product Officer at Ordr.

“I’ve been working with Ordr over the last year and have been impressed by the team, the technology, and their customer traction.  Ordr is redefining the connected device security market with an innovative product that addresses a variety of visibility and security use cases,” said Bonvanie, “I’m thrilled to take on the Executive Chairman role and look forward to working even more closely with Greg, Pandian and the executive team, building on Ordr’s record-breaking growth and seizing the opportunities ahead of us.”

This announcement comes on the heels of Ordr’s Rise of the Machines 2021 report, which analyzed connected devices across healthcare, life sciences, retail, and manufacturing verticals, uncovering a shocking number of vulnerabilities and risks. Download the full report for additional findings and details, “Rise of the Machines 2021: State of Connected devices — IT, IoT, IoMT and OT” .

Revelations by former Twitter cybersecurity chief-turned-whistleblower Peiter “Mudge” Zatko had tongues wagging across the industry Tuesday morning. Articles by CNN and the Washington Post included details from a 200-page letter Zatko sent to Congress, the Federal Trade Commission (FTC), Securities and Exchange Commission (SEC), and Department of Justice (DOJ) detailing claims of poor security practices and management by the social media giant. Zatko alleges Twitter’s security program is rife with bad practice, vulnerable devices, and executive apathy in violation of privacy and security assurances it made to regulators following a major data breach in 2020.

According to CNN, one of the concerning allegations is that, “About half of the company’s 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors.” The report also claims that, of the computers employees use for work—including accessing sensitive production environments—“4 in 10 devices do not meet basic security standards.”

Twitter denies Zatko’s accusations and told CNN in a written statement, “What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context.”

Device Vulnerability is an Unavoidable Reality

Whatever the outcome of any subsequent investigation, the situation described by Zatko might have many CISOs sleeping fitfully tonight as an environment populated by vulnerable devices is more common that many will publicly admit. And it doesn’t mean that the tech and security leaders in those organizations are derelict in their duties. Often, running such at-risk gear is an unavoidable necessity.

Industrial IT environments frequently include state-of-the-art IoT (internet of things) technology on the same network as equipment and operational technology (OT) that is decades old, running with obsolete operating systems and unsupported software. Such devices were not built to be secure because they were never intended to be connected to the public internet.

In healthcare organizations the challenges are even greater. Many connected medical devices in the realm of what is known as the internet of medical things (IoMT) must remain in service for the sake of patient safety, even if those devices are known to exhibit vulnerabilities. And because of FDA regulations intended to maintain a device’s operational integrity, typical patch management practices cannot be followed when vulnerabilities are discovered.

Unknown, Unseen, Unmanaged

Compounding the challenge for cybersecurity leaders is that many of these devices are unmanaged, and may operate outside the view of IT management. That adds up to potentially thousands of IoTdevices, building controls, security equipment, consumer-grade tech, and other unknown, unseen, and unsecured devices operating at risk on the network. The result is critical healthcare, manufacturing, and public and commercial infrastructure environments with an enormous attack surface and, using legacy tools and traditional strategies, with no way to understand the scale of the risk and secure the enterprise. Fortunately, there is a solution to close this gap.

The Ordr platform “passively” scans an enterprise network to discover and classify all the devices that are connected, including medical devices, operational technology, building controls, traditional IT systems  and more. Within minutes of deployment, Ordr provides full, real-time visibility of the environment fromIoT, IoMT, OT, and other connected devices comprising the organization’s complete asset inventory, as well as how the devices are connected, and what other systems they are communicating with.

Ordr has You Covered

Ordr identifies risks for every device via an integrated threat detection engine, threat intelligence feeds, and continuously enriching device profiles within the Ordr DataLake. Ordr also monitors and compares device activity against a baseline of “normal,” good behavior.  Because devices are deterministic and therefore should operate within specific, narrow parameters based on functions, abnormal behaviors that may be indicative of a cyberattack are easier to identify. Any suspicious behavior or unexpected communications patterns trigger automated alerts. When that happens, Ordr can dynamically generate Zero Trust security policies to contain an attack, while keeping mission-critical devices in service.

Read more about the award-winning Ordr connected device security platform, here, or contact us with any questions you may have about how we can help you secure your enterprise environment.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.