SANTA CLARA, Calif. and LONDON, Jan. 3, 2023 /PRNewswire/ — Ordr, the leader in connected device security, today announced a new partnership with U.K.-based NGS (Next Generation Security), a specialist cybersecurity reseller providing consultancy, support and managed services.

Recent efforts, across all industries, at digitally transforming the workplace to become more efficient and effective have led to the growing adoption of connected devices and equipment. While these advancements have helped improve the way we work, each new device or equipment connection increases an organisation’s attack surface, making it exponentially harder for IT and security teams to be sure they have visibility into every device and connection in their network environment.

The combination of Ordr’s powerful, AI-driven connected device security platform with NGS’ years of cybersecurity implementation expertise will bring U.K.-based businesses the innovative technology solutions they need to fully understand, manage, and secure the growing number of connected devices in their environment, including Internet of Medical Things (IoMT), Internet of Things (IoT) and Operational Technology (OT).

“It can be overwhelming for organisations to try and keep track of all of their connected devices, especially in periods of high growth and technological advancement,” said Jonathan Lassman at NGS. “With Ordr’s platform, real-time asset inventory about devices, identification of vulnerabilities and risks, along with automated policies to secure them, will be available to every IT and security team.”

Ordr makes it easy to protect every connected device, regardless of location or exposure. With the Ordr platform, organisations can establish proactive security policies that enable communications required for device operations, while limiting exposure. In addition, organisations can quickly mitigate risks during an attack by quarantining devices, blocking traffic, terminating sessions or implementing Zero Trust segmentation.

“The speed with which technology is adopted and updated in today’s business world means that you need a combination of expertise and innovative solutions on your side in order to maintain a strong security posture,” added Kieran Wood, Sales Director EMEA of Ordr. “NGS is well-known for its ability to understand the modern threat landscape and protect its clients from the latest attacks. We’re thrilled to work with them on extending that expertise to connected devices.”

Get more information on how Ordr and NGS can deliver device visibility and security to your organization.

Listening to the third and final webinar of the Minnesota HIMSS webinar series, Medical Device Security Overview for Healthcare Delivery Organizations with speakers Matt Dimino and Carrie Whysall from CynergisTek, I found the following useful tips when developing a medical device security program.

Medical Device Security

Medical devices are difficult to secure on a technical level. They are expensive and their operating systems typically stay the same while in service. These devices are not easily remotely managed, may not be able to be encrypted, and have default user passwords.

IoMT Security Components

To develop a thorough security program you should plan it in three stages:

Stage 1: Risk Assessment

• Assess the total program risk you have
• Multi-dimensional risk contextualization: consider device master data record, patch/mitigation prioritization, device inter-relationships, & risk monitoring
• Ask yourself what practices are the preceding security program missing

Stage 2: Program Development

• Lifecycle management approach: managing procurement, installation, maintenance, incident response & retirement procedures
• Improve asset management and create network visibility
• Standardize security policies and procedures

Stage 3: Program Management

• Assist with medical device procurement and decommissioning
• Provide IoMT device training and awareness
• Manage continuing vulnerability reporting and remediation programs

Device Risk

When trying to secure your medical devices you should be looking at all of the risk areas. Security vulnerabilities pose a threat to patient safety, medical device availability, and could result in financial loss or unauthorized access to information.

How to Analyze Risk

Risk analysis should follow these steps:

• System characterization: Gather data on hardware & software
• Threat identification: Look at the full spectrum of possible threats
• Vulnerability analysis: Ask how do vulnerabilities impact devices and protocols
• Controls analysis: Look at controls already in place and what is needed
• Likelihood determination: Ask what are the chances of a device being compromised
• Impact analysis: Ask how a compromised asset would affect the organization
• Risk determination: Ask what risk level a device should be placed in
• Controls recommendation: Determine what controls assets need to mitigate vulnerabilities
• Results documentation: Share information and communicate with stakeholders

Risk Criteria & Categorization

When determining device risk level it is important to consider the likelihood of threat occurrence as well as the potential impact of threat occurrence on patients, business, and data.

Risk categorization aids in risk prioritization and remediation. You can categorize risks through device threat modeling: collecting device data, establishing a hypothesis, threat hunting, threat detection, and threat response.

Governance

It takes a team to create and manage a medical device security program. Setting a purpose and objective for this committee is key. The Responsible Accountable Consulted Informed (RACI) Matrix can help organize stakeholders and ensure everyone is aware of their role and responsibilities.

How Ordr Can Help

Developing a medical device security program can be a difficult and lengthy process. Ordr can help.

The Ordr System Control Engine (SCE) gives organizations the power to enable visibility and security of their network-connected devices, with a simple and powerful solution to identify, classify, profile the behavior and risk and automate action for every network-connected device in the enterprise. Want to experience Ordr on your network? Request a free sensor.

Internet of Things (IoT) are now in every aspect of enterprises. As businesses grow, adding more and more devices to their networks, they face unique challenges in securing IoT. Frost and Sullivan, in their most recent report “Strategic Assessment of the IoT Security market” expects the number of IoT devices to grow from around 34 billion devices in 2020 to over 60 billion by 2025″:

As IoT adoption increases, IoT security is becoming critical. Many IoT devices lack basic security features, cannot be easily patched, and run obsolete operating systems. The ideal scenario is to build security into these devices, which some states and the Federal government are advocating via legislation such as the California SB327 or the IoT Cybersecurity Improvement Act. But with billions of insecure IoT devices already deployed, organizations need cybersecurity solutions that can address IoT security today.

In this report, Frost and Sullivan also calls out the need for an IoT security solution that offers the following:

• Network Monitoring: Network monitoring, or network detection and response solutions that incorporate deep packet inspection technologies can extract granular insights about devices. This can be combined with artificial intelligence (AI) and machine learning (ML) technologies to map and baseline every device communications.
• Integrated IT, IoT, and OT Cybersecurity: As IT and IoT/OT networks, the need for multifunction platform that offer the “whole enterprise” approach is important.
• IoT Risk Management: A solution that can help identify risks and defines anomalous behavior is important
• Network Segmentation: A good best practice to protect connected devices is via segmentation. Zero Trust segmentation ensures devices have appropriate access required for its role, while limiting access, and can be enforced on next-generation firewalls or in the network (switches, network access control)

In fact, these are the key building blocks of the Ordr platform – a whole organization approach to device security that combines DPI with AI to classify devices, profile risks and behavior and automate response including Zero Trust segmentation. Our capabilities include:

• Device discovery: Within a few hours of deployment, Ordr discovers high-fidelity context on every connected device, including make, OS, location and application/port usage
• Device flow analytics and baselining: Ordr passively monitors network communications and creates a conversation map, called the Ordr Flow Genome, for every connected device.
• Security response: Ordr automates device identification and uses AI to baseline normal communication behavior, then translates these behaviors into a device-specific security policy
• Detection of internal reconnaissance and lateral movement: For reconnaissance and sniffing, the Ordr behavioral baseline of the compromised devices can spot these activities as soon as the flow starts to a destination from a device that has the malware infection to a device to which it has never had any flows
• Comprehensive device insights for businesses: Ordr sees the device the moment it becomes active in the network, records operational activity and records the time it goes offline

Learn more about Ordr’s IoT security solutions.

Enterprise organizations often rely on a diverse set of security tools to protect all assets across their network. The biggest challenge for CISOs and their teams is understanding the coverage efficacy of these security tools because managed and unmanaged asset data is scattered across various platforms in today’s modern networks. Without in-depth asset context, teams struggle to make informed decisions and identify coverage gaps and missing security controls.

Ordr’s Approach to Surface Coverage Gaps and Missing Security Controls

Ordr believes that for a Cyber Asset Attack Surface Management (CAASM) solution to be effective, it must include foundational features such as accurate asset inventory and classification. These key features provide the in-depth asset context necessary to make informed decisions, uncover coverage gaps, and identify missing security controls. Ordr utilizes AI/ML techniques to categorize every connected asset within the network and assign a three-level hierarchy. This model establishes boundaries based on asset classification thus eliminating the need for manual processes and guesswork. With accurate asset inventory and classification, CISOs can automatically know when:

• Endpoints are missing critical security controls like EDR or MDM
• Assets are banned by the federal government
• Assets are running out-of-date software
• Assets have weak passwords

Ordr CAASM+ integrates with industry-leading security solutions to share data and insights such as when there are missing security controls or coverage gaps. That information helps users to customize their views to meet specific business requirements. Recommended data integration sources for Ordr CAASM+ include:

• Vulnerability Assessment Systems
• Ordr Discovery Engine
• Cloud Assets
• CMDB
• MDM
• EDR

Because these insights are being analyzed and delivered in real-time any changes that affect risk are available immediately. That means Ordr CAASM+ provides an ideal framework for remediation with multiple enforcement options, including:

• Network based enforcement (changed VLAN, shutdown port, integrate with firewall)
• Integration with messaging/collaboration tools
• Integration with ticketing system

Watch this short video to see how CAASM+ empowers you to identify coverage gaps and missing security controls.

Thanks for joining us for the first deep dive into our CAASM+ use cases! Follow along over the next few weeks as we delve into more of our CAASM+ use cases to understand why they are important and how Ordr addresses them.

Ready to start the conversation? Connect with one of our experts for a personalized demo.

Srinivas Loke

Srinivas Loke is Vice President of Product Management at Ordr. Srinivas has a passion for cybersecurity with a deep understanding of network, end point, cloud and IoT security. Prior to Ordr, he led product teams at Aruba, Pulse Secure, FireEye and McAfee. He loves taking 1.0 products to the market and furthering cutting edge technologies that are solving customer problems.

SANTA CLARA, Calif., March 15, 2022 /PRNewswire/ — Ordr, the leader in connected device security, has been named a Representative Vendor in the 2022 Gartner Market Guide for Medical Device Security Solutions for the second year in a row.

Ordr was named a Representative Vendor in the 2022 Gartner Market Guide for Medical Device Security Solutions.

“The variety and scale of security risks are significant in the IoMT-rich healthcare environment and create a large and complex threat surface. At the same time, most sensor-based things have minimal internal computing resources, with limited opportunities to install antivirus, encryption and other forms of protection. However, they commonly connect to HDO back-end computing resources and require protection,” said Gregg Pessin, Sr. Director Analyst at Gartner.

The Market Guide for Medical Device Security examines the growing market for solutions that address software, hardware, and network and data protection requirements for an HDO’s IoMT devices. These solutions enable organizations to securely manage IoMT devices, ensure IoMT endpoint and data integrity, and perform asset discovery.

Three key findings were called out in the Gartner report:

• “Most healthcare delivery organization (HDO) CIOs and chief information security officers (CISOs) do not have an up-to-date, complete and accurate inventory of the medical devices within their enterprises. This thwarts efforts to protect their healthcare delivery environments from continuous security threats.
• Internet of Medical Things (IoMT) and Internet of Things (IoT) device populations are growing in size and diversity within HDOs. This growth drives increased smart device network traffic and the size and complexity of the resulting threat surface.
• Market solutions that address these issues started with simple discovery and risk scoring, and have developed into full-fledged security protection systems for IoMT populations inside HDOs.”

“The number of connected devices in healthcare organizations has grown exponentially. Unfortunately, this brings with it a significant increase in attack surface,” said Greg Murphy, CEO of Ordr. “Ordr works with leading healthcare organizations to profile every connected device, deliver actionable insights into threats, vulnerabilities, and anomalous behavior, and secures every device with automated policies. We are pleased to be recognized by Gartner as a Representative Vendor to address critical visibility and security requirements within healthcare.”

Ordr recently announced its Clinical Defender solution, which gives Health Technology Management (HTM) professionals visibility into exactly what medical devices are connected to an organization’s network. The solution enables one-click access to critical HTM data, accelerates risk remediation workflows, and delivers device utilization insights.

With the holiday season in full effect, retailers like Walmart and Amazon are rolling out the Deal of the Day. Well, with these deals, comes a great cost savings, but what we also need to take in to account are the risks of these devices. While it is probably fine (although not encouraged) if they are deployed at home, putting these devices on your organizations corporate network can be far more dangerous.

There has been a recent spike in these types of routers being plugged into corporate networks and most of the time by employees who want to either extend the ethernet ports or have their own private network. With the router acting as a gateway NAT-ing all the devices behind it, this becomes an untracked shadow network. Traditional endpoint detection tools cannot detect these types of devices and the potential dangers.

Take the example of the recent reports of the $30 Wi-Fi routers sold at retailers like Walmart and Amazon. Researchers found that these routers contained hidden backdoors and are being exploited by the Mirai botnet. The routers with the reported security hole are the Jetstream router that can be easily purchased, with no disclaimer. These critical vulnerabilities allow threat actors to remotely control the routers as well as any device connected to that network and monitor all the traffic coming through that router. This constant surveillance on the shadow network can critically endangers the whole network. Additionally, the Wavlink routers contain a script that lists nearby Wi-Fi networks and could connect to those networks with the factory passwords. This can have a cascading effect with the attacker slowly and patiently expanding the blast radius.

Ordr installed these two routers in our lab environment and almost instantly noticed port-443 connection communicating to known Chinese domains.

With Ordr, these devices can be easily identified, classified and added to the “Hi-risk Manufacturers” profile.

The next challenge is to physically locate these devices so that this can be investigated and removed. Ordr provides device location and also physical connectivity information so that this device can be tracked, and the appropriate workflow is supported.

Identifying these rogue devices is important in protecting your network infrastructure.  With Ordr’s ability to see all connected devices via DPI and support massive network infrastructures through AI/ML to classify these devices at scale, then automate policy generation, we can help our customers discover, baseline, and secure their environments.

For more information on how Ordr can help you identify and manage vulnerabilities for any connected device, please contact info@ordr.net.