Corelight and Keysight

Corelight and Keysight Help Midwest Power Company Save Energy While Securing a High-Speed OT Network 

With more devices coming online every day, a 100-year-old provider of electricity and natural gas services to more than 1 million customers began upgrading its operational technology (OT) network to higher speeds—10G at first with future plans for 25G and 40G. To maintain control, they decided to modernize their IT/OT network monitoring infrastructure to accelerate threat detection at some 30 data centers across their serving area.

Enter Corelight and Keysight. The plan to upgrade security and performance monitoring began with replacing outmoded intrusion detection systems (IDS) and network detection and response (NDR) technology with new Corelight solutions to analyze the OT traffic for threats. At the same time, the company rolled out Keysight Vision Edge network packet brokers (NPBs) to deliver analysis-ready traffic to the new Corelight tools.

Here’s why . . .

Sidestepping Risk Takes Clear Goals and Close Collaboration

Many energy providers and other utility companies find themselves in an unenviable position: they face higher-stakes, and even life-threatening risk from cyberattacks but often have gaps in visibility and security controls. Cyberattacks on OT environments can put worker safety, equipment, and operations at risk, cause costly outages, and lead to regulatory fines for failing to protect critical infrastructure and customer data. 

Cyber risk reaching an all-time high

For some, the increased exposure to cyberthreats can offset the efficiencies gained by interconnecting IT and OT systems. Downtime, fines, and loss of reputation can even put smaller companies out of business. Risk builds quickly as OT and Industrial Internet of Things (IIoT) devices and users become instant, vulnerable targets for phishing, social engineering, and ransomware attacks (who can forget Colonial Pipeline?) and lateral movement through the environment to take down operations.

New threats originate from every direction—like remote access, third-party supply chain partners, even well-meaning insiders—faster than ever before.

IT, OT, and security teams band together

Consolidating IT and OT network infrastructures—and avoiding security breaches—takes precise orchestration and strong collaboration across formerly disparate systems, and teams. Before upgrading their monitoring operations, system engineers and cybersecurity managers and architects worked together to define objectives and metrics for measuring success.

The cross-functional team wanted its new visibility and monitoring infrastructure to provide:

• Extended visibility to remote power substations
• A consolidated view of IT/OT operations 
• High-capacity processing of consolidated network traffic
• An easy to use, cost-effective solution that would scale to meet future needs

Upgrading Security Safeguards Uptime

Now that they’re exposed to the Internet and cloud, protecting OT and industrial solutions that never needed security before takes a high priority. The power company’s team set out to find modern IDS and NDR capabilities to visualize newly connected devices and accelerate threat detection. After conducting a proof of concept (PoC) demonstration, they began upgrading their old IDS and vulnerability management (VM) systems to Corelight security monitoring solutions. The next decision required less effort.

Keysight visibility offered a clear choice

The midwestern electricity provider was already a satisfied customer of Keysight’s T1000 “Tough Taps,” ruggedized visibility solutions for challenging remote and industrial environments. They liked Keysight’s flexible deployment options, scalable architecture and lower cost-of-ownership compared to competing visibility solutions.

Like most users of the Keysight visibility platform, the team found the world-class graphical user interface (GUI) easy to use. They also liked Keysight’s advanced processing capabilities and knew they could scale to meet future needs.

Keysight also received a vote of confidence from the Corelight team which reassured the customer that rolling out a proven joint solution would go smoothly. The team began migrating their existing T1000 Tough Taps to future-ready Vision Edge 40 (E40) packet brokers that could handle current and future speeds of 40G or higher. The E40s deliver high-performance traffic aggregation and intelligent filtering and replication of traffic to Corelight and other monitoring tools.

Joint solutions from Corelight and Keysight can also handle intensive future demands like TLS/SSL traffic decryption.  Download the solution brief to learn more.

Related

Resources