In the Fireside Chat: Addressing IoT Security Risks with Nexteer Automotive webinar, I discussed best practices for organizations building IoT security programs with Ron Temske, VP Security at Logicalis, and Jeff Horne, CISO at Ordr.

Background

The winds of change are blowing through the world of work today. Macro trends such as Industry 4.0 require that companies enact and accelerate their digital transformation. Technologies such as artificial intelligence, blockchain, cloud computing, autonomous vehicles, robotic process automation, edge computing, and the Internet of Things (IoT) are helping foster innovation and competitive advantage.

As companies embrace digital manufacturing to increase efficiency and optimize operating costs, there is an explosion of IoT devices on the plant floor. Further, more and more of our home devices are becoming internet connected. The exponential proliferation of IoT devices and immature security practices make them targets for attack.

Addressing IoT Security Risks

IoT devices play critical roles across many business functions across enterprises, making building IoT security programs crucial. Here are my tips for tackling IoT security, the “Magnificent 7 IoT Security Guiding Principles”:

1. Characterize: Identify and classify assets and stratify them by business value and risk
2. Demarcate: Implement network zones with a clear demarcation between IT and OT networks
3. Understand: Visualize and identify threats and vulnerabilities across networks inclusive of devices, traffic, etc.
4. Unify: Control access by users and devices across both secure wireless and wired access
5. Adapt: Leverage Zero Trust to enact adaptive control schemes in real time
6. Converge: Develop explicit third-party access and risk management protocols including Privileged Remote Access, which are particularly relevant to OT networks to strengthen the security architecture
7. Beware: The following root causes have led to IoT device security issues in the past
   • Static credentials embedded in the device
   • Lack of encryption
   • No software updates
   • API security gaps

How Ordr Can Help

Besides sharing tips on creating an IoT security plan, I also shared the reasons why Nexteer chose Ordr over other IoT security solutions.

One of the key principles of our InfoSec & Privacy program, NEXTINTRUST is to leverage the trifecta of: IDENTITY, INTEGRATION & INSIGHTS across a layered security architecture for enacting adaptive, proactive control strategies.

Consequently, key dimensions needed to enact this strategy across the OT & IoT arena are:

• Device Visibility
• Policy Definition
• Behavior & Risk Analysis
• Enforcement of Policies & Standards

Ordr mapped well to Nexteer’s key security dimensions and the NIST cybersecurity framework principles of Identify, Detect & Protect. It can help us transform our security operations across the plant floor and IOT device arena.

Ordr offers a realtime dashboard and key insights such as automatic device inventory, device communication, and device risk analysis. Ordr’s ease of deployment, FIPS certification, and all-inclusive licensing model were also differentiators.

Ready to try Ordr for yourself? Request a demo to see how Ordr will discover and classify all connected devices, profile device behavior, and automate segmentation policies.

Arun DeSouza

Arun DeSouza is currently Chief Information Security & Privacy Officer at Nexteer Automotive Corporation. He has extensive global IT and security leadership and organizational transformation experience including as CISO and CIO. Arun’s areas of expertise include strategic planning, risk management, identity management, cloud computing and privacy. His current interests include the Internet of Things (IoT), Blockchain, Zero Trust, Software Defined Perimeter & Self-Sovereign Identity. Arun earned Master’s and PhD degrees from Vanderbilt University. He is a Certified Information Systems Security professional (CISSP) and has earned the Certificate of Cloud Security Knowledge (CCSK) certification. He was honored by the 1st Global Cyber Observatory by induction into the CISO Hall of Fame in September 2019. He has won multiple other industry honors including CISO of the Week, CSO50 Award, Computerworld Premier 100 IT Leaders Award, CIO Ones to Watch Award and the Network World Enterprise All Star Award. He is a member of the Society for Information Management and the International Association of Privacy Professionals.

Internet of Things (IoT) are now in every aspect of enterprises. As businesses grow, adding more and more devices to their networks, they face unique challenges in securing IoT. Frost and Sullivan, in their most recent report “Strategic Assessment of the IoT Security market” expects the number of IoT devices to grow from around 34 billion devices in 2020 to over 60 billion by 2025″:

As IoT adoption increases, IoT security is becoming critical. Many IoT devices lack basic security features, cannot be easily patched, and run obsolete operating systems. The ideal scenario is to build security into these devices, which some states and the Federal government are advocating via legislation such as the California SB327 or the IoT Cybersecurity Improvement Act. But with billions of insecure IoT devices already deployed, organizations need cybersecurity solutions that can address IoT security today.

In this report, Frost and Sullivan also calls out the need for an IoT security solution that offers the following:

• Network Monitoring: Network monitoring, or network detection and response solutions that incorporate deep packet inspection technologies can extract granular insights about devices. This can be combined with artificial intelligence (AI) and machine learning (ML) technologies to map and baseline every device communications.
• Integrated IT, IoT, and OT Cybersecurity: As IT and IoT/OT networks, the need for multifunction platform that offer the “whole enterprise” approach is important.
• IoT Risk Management: A solution that can help identify risks and defines anomalous behavior is important
• Network Segmentation: A good best practice to protect connected devices is via segmentation. Zero Trust segmentation ensures devices have appropriate access required for its role, while limiting access, and can be enforced on next-generation firewalls or in the network (switches, network access control)

In fact, these are the key building blocks of the Ordr platform – a whole organization approach to device security that combines DPI with AI to classify devices, profile risks and behavior and automate response including Zero Trust segmentation. Our capabilities include:

• Device discovery: Within a few hours of deployment, Ordr discovers high-fidelity context on every connected device, including make, OS, location and application/port usage
• Device flow analytics and baselining: Ordr passively monitors network communications and creates a conversation map, called the Ordr Flow Genome, for every connected device.
• Security response: Ordr automates device identification and uses AI to baseline normal communication behavior, then translates these behaviors into a device-specific security policy
• Detection of internal reconnaissance and lateral movement: For reconnaissance and sniffing, the Ordr behavioral baseline of the compromised devices can spot these activities as soon as the flow starts to a destination from a device that has the malware infection to a device to which it has never had any flows
• Comprehensive device insights for businesses: Ordr sees the device the moment it becomes active in the network, records operational activity and records the time it goes offline

Learn more about Ordr’s IoT security solutions.

Ordr To Share Best Practices for Gaining Visibility & Context into Every Connected Device (IT, IoT, IoMT, OT) across Cisco and Cisco Meraki Environments

June 1, 2024 – Ordr, the leader in AI-powered asset intelligence, today announced that it is presenting at Cisco Live 2024, an annual conference for IT professionals and enthusiasts to learn about Cisco’s latest innovations and industry trends. The event takes place from June 2-6, 2024 at the Mandalay Bay Convention Center in Las Vegas. It will also be broadcast globally so that people can participate from anywhere in the world.

Ordr’s deep integrations across Cisco and Cisco Meraki solutions provide visibility into every connected device (IT, IoT, IoMT, OT), including risks and behavior. 

Ordr’s speaking sessions are:  

“Hit the Accelerator on Cisco ISE/SDA for Zero Trust with Ordr – VILSEC-1045”

• Date & Time: Monday, June 3, 2024, from 2:00 – 2:15 p.m. PDT
• Location: Booth #3120 World of Solutions – Security Village Theater
• Presenters: Craig Hyps, Ordr Fellow and Cisco Live Hall-of-Fame Distinguished Speaker
• Description: In this short session, attendees will learn how to break barriers in Cisco ISE and SDA deployments through automated endpoint discovery with detailed classification, dynamic risk assessment and simplified segmentation. Fast track NAC and segmentation projects.

“OrdrAI – Automated Visibility, Security Posture, and Protection for the Cisco Enterprise – VILENT-1002”

• Date & Time: Monday, June 3, 2024, from 3:00 – 3:15 p.m. PDT
• Location: Booth #5590 Co-Sell Village Center Stage
• Presenters: Craig Hyps, Ordr Fellow and Cisco Live Hall-of-Fame Distinguished Speaker
• Description: Attendees will learn how Ordr leverages AI to simplify the user experience for traditionally complex tasks while ensuring compliance.

“Hit the Accelerator on Cisco ISE/SDA for Zero Trust with Ordr”

• Date & Time: Tuesday, June 4, 2024, from 11:30 – 11:45 a.m. PDT
• Location: Booth #6678, Cisco Industry Group – Manufacturing
• Presenters: Craig Hyps, Ordr Fellow and Cisco Live Hall-of-Fame Distinguished Speaker
• Description: In this short session, attendees will learn how to break barriers in Cisco ISE and SDA deployments through automated endpoint discovery with detailed classification, dynamic risk assessment and simplified segmentation. Fast track NAC and segmentation projects.

“OrdrAI Asset Intelligence and Gigamon: Enabling Your Security Portfolio for Increasing Threats”

• Date & Time: Tuesday, June 4, 2024, from 3:00 p.m. – 3:15 p.m. PDT
• Location: Booth #6278
• Presenters: Bryan Gillson, Ordr

“Simple Recipes for Cisco Firewall Segmentation and Zero Trust—Made to Ordr! – VILSEC-1050”

• Date & Time: Wednesday, June 5, 2024 from 3:00 – 3:15 p.m. PDT
• Location: Booth #3120 World of Solutions – Security Village Theater
• Presenters: Craig Hyps, Ordr Fellow and Cisco Live Hall-of-Fame Distinguished Speaker
• Description: In this short session, attendees will learn how to break barriers in Cisco FTD and ASA Firewall deployments through automated endpoint discovery with detailed classification, dynamic risk assessment and simplified segmentation. Learn how to fast track Cisco Firewall segmentation and Zero Trust projects.

The Ordr team will also be on-site at Cisco Live in booth 3120-A to answer questions about how Ordr and Cisco team up to accelerate ISE/SDA segmentation, optimize firewall security and leverage Cisco Meraki and Cisco Spaces.

About Ordr

Ordr addresses the entire asset management journey — from visibility and risk-based vulnerability management to advanced threat detection and Zero Trust segmentation. By utilizing unified data discovery methods, combined with AI/ML analytics, Ordr effectively eliminates asset noise, prioritizes the top exposure to the organization, and delivers rapid threat containment using automated actions. Trusted by global enterprises across various sectors, Ordr improves security hygiene, expedites incident response, and facilitates Zero Trust segmentation initiatives. Ordr is backed by top investors including Battery Ventures, Wing Venture Capital, Ten Eleven Ventures, and Kaiser Permanente Ventures. Stay up to date on the latest news and updates, follow Ordr on X and LinkedIn.

Media Contact

Michele Moyer

Guyer Group for Ordr

+1.650.269.1442

Santa Clara, CA – November 2, 2022 – Ordr, the leader in connected device security, announced today that Jim Hyman has been appointed Chief Executive Officer (CEO) and member of the company’s Board of Directors. With more than 25 years of deep experience in cybersecurity and technology, and a proven record of scaling and operating companies for growth, Hyman will use his experience to continue building a world-class organization as the company enters a new phase of growth. Hyman was most recently Chief Operating Officer at Synack, VP Sales at Trusteer prior to its acquisition by IBM, and spent 4 years as the VP of Sales at Zscaler. Hyman succeeds Greg Murphy as CEO, who is leaving to pursue other interests, but will remain an advisor to the company.

“Jim’s background in cybersecurity and his experience across sales, business development and operations make him the perfect leader to accelerate Ordr’s growth. He embodies our customer-centric culture, represents our values, and has a clear vision for Ordr’s future,” said René Bonvanie, Chairman of the Board of Directors at Ordr. “On behalf of the board, I want to thank Greg for his significant contributions as CEO for the past four years.”

With the explosive growth of connected devices, security and IT leaders are looking not only for visibility into what’s actually connected to their network but a complete suite of security features to identify devices with vulnerabilities, detect anomalies and respond to cyberattacks. With Ordr’s connected device security platform, security and IT leaders are able to discover and classify what is connected to the network, in real-time, via an agentless approach.

Ordr identifies devices with risks, such as those with vulnerabilities, running outdated operating systems, behaving anomalously or communicating to a malicious domain. Proactive Zero Trust policies can be applied to keep devices in operation while limiting exposure. When a device is compromised, organizations can move quickly from “detection” to “response” by taking advantage of Ordr’s insights into the device and dynamically generating policies to mitigate risks.

“I’m thrilled to join Ordr at such an exciting time and look forward to building on the company’s foundation of world-class, innovative technology in the connected device security market,” Hyman said. “Ordr is uniquely poised to address visibility and security challenges with the growth of connected devices and also accelerate the digital transformation and Zero Trust initiatives across multiple industries. We have unparalleled technology and an enormous opportunity ahead of us.”

“When we founded Ordr, our goal was to help organizations address their connected device security challenges,” said Pandian Gnanaprakasam, Ordr co-founder and Chief Product Officer. “Our growth and customer momentum validates our best-in-class approach. Jim is the right person at the right time. His experience and passion, combined with Ordr’s extraordinary market position and financial resources, put Ordr in a perfect position to capitalize on new opportunities, offer best-in-class customer experiences, and accelerate growth. I look forward to working with Jim as we continue to scale.”

SANTA CLARA, Calif., March 15, 2022 /PRNewswire/ — Ordr, the leader in connected device security, has been named a Representative Vendor in the 2022 Gartner Market Guide for Medical Device Security Solutions for the second year in a row.

Ordr was named a Representative Vendor in the 2022 Gartner Market Guide for Medical Device Security Solutions.

“The variety and scale of security risks are significant in the IoMT-rich healthcare environment and create a large and complex threat surface. At the same time, most sensor-based things have minimal internal computing resources, with limited opportunities to install antivirus, encryption and other forms of protection. However, they commonly connect to HDO back-end computing resources and require protection,” said Gregg Pessin, Sr. Director Analyst at Gartner.

The Market Guide for Medical Device Security examines the growing market for solutions that address software, hardware, and network and data protection requirements for an HDO’s IoMT devices. These solutions enable organizations to securely manage IoMT devices, ensure IoMT endpoint and data integrity, and perform asset discovery.

Three key findings were called out in the Gartner report:

• “Most healthcare delivery organization (HDO) CIOs and chief information security officers (CISOs) do not have an up-to-date, complete and accurate inventory of the medical devices within their enterprises. This thwarts efforts to protect their healthcare delivery environments from continuous security threats.
• Internet of Medical Things (IoMT) and Internet of Things (IoT) device populations are growing in size and diversity within HDOs. This growth drives increased smart device network traffic and the size and complexity of the resulting threat surface.
• Market solutions that address these issues started with simple discovery and risk scoring, and have developed into full-fledged security protection systems for IoMT populations inside HDOs.”

“The number of connected devices in healthcare organizations has grown exponentially. Unfortunately, this brings with it a significant increase in attack surface,” said Greg Murphy, CEO of Ordr. “Ordr works with leading healthcare organizations to profile every connected device, deliver actionable insights into threats, vulnerabilities, and anomalous behavior, and secures every device with automated policies. We are pleased to be recognized by Gartner as a Representative Vendor to address critical visibility and security requirements within healthcare.”

Ordr recently announced its Clinical Defender solution, which gives Health Technology Management (HTM) professionals visibility into exactly what medical devices are connected to an organization’s network. The solution enables one-click access to critical HTM data, accelerates risk remediation workflows, and delivers device utilization insights.

Microsoft is warning users of legacy Windows OS systems that they must act quickly to patch the newly-detected BlueKeep Wormable vulnerability or face dire consequences that could rise to the level of the WannaCry attack that shut down systems worldwide in 2017.  Yikes.

To prevent another such catastrophic and global ransomware propagation, organizations are scrambling to identify and remediate assets that are vulnerable as per Microsoft’s recent announced critical flaw CVE-2019-0708 that affects legacy operating systems — Windows 2003, Windows 7, Server 2008, and XP. However, this remains a daunting challenge for enterprises who have deployed vast numbers of network-connected devices – medical, industrial, manufacturing, facilities, and other OT/IOT – that run on embedded legacy Windows operating systems.  In today’s hyper-connected enterprise, the massive quantity and heterogeneity of these connected devices makes the task of addressing this critical vulnerability even more daunting.

Take control with Ordr.

The Ordr Systems Control Engine, or SCE, can quickly and automatically identify all devices connected to your enterprise network that are vulnerable.  Critically, the Ordr SCE uses only passive monitoring techniques, which – unlike active vulnerability scanning tools – will not disrupt your mission-critical and often sensitive equipment. You can procure a list of these systems quickly, and bypass the traditionally manual and time-consuming process of physically tracking down known inventory assets and assessing each individually for risk and vulnerability.  Timing is critical, so eliminating this manual process will save you not only time and money, it could be critical in protecting your brand, in ensuring the security of your data, in possibly saving lives.

Once you know what’s at risk, you can easily use the Ordr SCE to automate and deploy microsegmentation policies, enabling your infrastructure to basically operate as a bodyguard for each device, to isolate and protect each device from any future exploit that weaponizes CVE-2019-0708. These protections can be implemented in your existing network and security tooling, such as your switches, NAC tools, and firewalls. This compensating control allows you to dramatically reduce the risk so you can confidently continue to operate your legacy equipment until, at some point, the manufacture provides a patch.

Here’s a video that shows you how Ordr can help. Contact us to learn more.