Gigamon and ORDR: Comprehensive IoT, IoMT and OT Device Visibility, Discovery, Classification and Security
Comprehensive IoT, IoMT and OT Device Visibility, Discovery, Classification and Security
IoT And OT Are Expanding Faster Than They Can Be Secured
The number of IoT and other connected devices is exponentially increasing on enterprise networks, often without knowledge of their connection, location, specific purpose, or security team awareness. These devices present unique challenges to discovery, risk assessment, and security as they typically access the network without authentication or an associated user. Many connected devices – particularly IoMT, OT, and ICS devices – are highly vulnerable, often running rudimentary or minimized versions of legacy operating systems without basic client protection software. Additionally, they are commonly closed, proprietary systems with minimal or no patching capabilities to defend themselves meaning that installation of security or device management software is rarely an option.
The bottom-line is that, despite their operational benefits, IoT, IoMT, and OT devices introduce security vulnerabilities and visibility blind spots that significantly increase risks that can result in service disruption, data theft, or compromise leading to ransomware and other attacks.
Take Control of Your Enterprise
The basic tenet of security is that “you cannot secure what you cannot see.” Gigamon and ORDR have teamed to deliver complete visibility and control into everything connected to your infrastructure including unmanaged workstations and servers, medical and industrial devices, building automation systems, smart branches and offices, payment processors in PCI zones, as well as the wide variety of other connected devices increasingly found on enterprise networks.
GIGAMON HAWK DEEP OBSERVABILITY PIPELINE
• Efficiently collects high-fidelity, data-in-motion from your hybrid-cloud infrastructure including East-West and Encrypted data
• Aggregates traffic to create a consistent, complete view of data-in-motion
• Optimizes traffic sent to network, security and observability tools to maximize their efficiency and ROI
• Transforms traffic using techniques including de-duplication, advanced filtering and metadata generation
• Eliminates the limitations of using SPAN ports and Cloud Mirroring to collect data-in-motion to enable complete monitoring and deep observability
• Supports centralized TLS decryption, ensuring visibility into encrypted payloads and relieving load on firewall
ORDR CONNECTED DEVICE SECURITY
• Passively discovers all connected devices by analyzing device traffic from sources such as Gigamon
• Automatically and accurately classifies devices with granular details
• Identifies security vulnerabilities, active threats, and calculates a risk score for each device
• Learns device behaviors to establish baselines of normal communication and enables quick detection of anomalous activity
• Automates policy to mitigate risks during an attack by quarantining devices, blocking traffic, or terminating sessions, and proactively improves security with policy for Zero Trust segmentation and NAC
The Solution
Total Device Visibility And Security
ORDR is the industry’s most comprehensive platform for visibility and security of all connected devices. ORDR leverages passive, deep packet inspection and protocol decoding to automatically classify every device and extract rich context such as make, model, OS, and software/hardware versions. Device asset inventory is correlated against industry security feeds to detect vulnerabilities, and traffic is monitored to detect threats, assess risk, and establish baselines for normal and safe device communications. Device baselines enable ORDR to alert on anomalous behavior, automate response, and dynamically generate micro segmentation policies to protect critical connected devices.
To ensure accurate device classification and comprehensive visibility into all device communications, it is essential to have complete, consistent high-fidelity traffic collection across the network. Gigamon Hawk Deep Observability Pipeline optimizes collection of data-in-motion for all North-South, East-West and Encrypted traffic across an organization’s hybrid infrastructure. This data is aggregated, transformed, and optimized before being delivered to ORDR, establishing complete visibility into all connected devices and device communications. Gigamon also eliminates SPAN and Cloud Mirroring performance and inefficiency issues using both physical and virtual taps that scale to ensure high-fidelity data is collected and aggregated across an entire hybrid infrastructure regardless of scale. This approach enables Gigamon to significantly reduce the number of sensors required to discover and monitor every device connected to your infrastructure, simplifying your network and security monitoring architecture.
ORDR ANALYZES DATA-IN-MOTION CAPTURED AND OPTIMIZED BY GIGAMON HAWK TO PROVIDE HIGH-FIDELITY DEVICE CONTEXT…
…AND COMPLETE VISIBILITY INTO ALL DEVICES AND DEVICE COMMUNICATIONS.
Gigamon And ORDR Use Cases
• Real-time asset inventory – ORDR continuously analyzes device traffic sent from Gigamon to passively discover and automatically classify every device connected to the network to help you maintain an up-to-date and accurate inventory.
• Medical device utilization – ORDR provides detailed medical device utilization insights for high-capital equipment to help inform maintenance tasks and capital purchase decisions.
• Connected device risk – using the traffic captured and optimized by Gigamon Hawk, ORDR calculates device risk scores and uncovers connected devices with risk such as outdated operating systems, unpatched software, weak passwords, and manufacturer recalls. ORDR also maps and baselines device communications to identify risk and stop attacks.
• Accelerate Zero Trust – working together, Gigamon and ORDR can map and baseline all IT, IoT and other device communications. ORDR can then dynamically create Zero Trust policies to simplify and accelerate NAC and segmentation projects. These policies can be enforced with popular security and network devices to integrate with existing infrastructure tools.
Summary
The Gigamon Hawk Deep Observability Pipeline provides access to all the data-in-motion across an organization’s hybrid infrastructure and enables ORDR to keep track of all your connected devices, understand how they communicate, and improve security. Gigamon Hawk aggregates, transforms and optimizes data-in-motion before routing it to ORDR ensuring that it can be processed quickly and efficiently. Gigamon and ORDR can be deployed in physical or virtual data centers or in the public cloud and work together seamlessly to ensure organization-wide visibility and security of connected devices.
Numerous customers across all industries already deploy the joint Gigamon and ORDR solution in their networks, enjoying unparalleled network and device visibility and control. For more information or to see a demonstration, please contact your reseller.
ABOUT ORDR
ORDR makes it easy to secure every connected device, from traditional IT devices to newer and more vulnerable IoT, IoMT, and OT. ORDR Systems Control Engine uses deep packet inspection and advanced machine learning to discover every device, profile its risk and behavior, map all communications and protect it with automated policies. Organizations worldwide trust ORDR to provide real-time asset inventory, address risk and compliance and accelerate IT initiatives. ORDR is backed by top investors including Battery Ventures, Wing Venture Capital, Ten Eleven Ventures, Northgate Capital, Kaiser Permanente Ventures, and Unusual Ventures. For more information, visit www.ordr.net and follow ORDR on Twitter and LinkedIn.
ABOUT GIGAMON
Gigamon® offers a deep observability pipeline that harnesses actionable network-level intelligence to amplify the power of observability tools. This powerful combination helps IT organizations to assure security and compliance governance, speed root-cause analysis of performance bottlenecks, and lower operational overhead associated with managing hybrid and multi-cloud IT infrastructures. The result: modern enterprises realize the full transformational promise of the cloud. Gigamon serves more than 4,000 customers worldwide, including over 80 percent of Fortune 100 enterprises, 9 of the 10 largest mobile network providers, and hundreds of governments and educational organizations worldwide. To learn more, please visit gigamon.com.