Support Site

Updates

TDi Technologies is First to Complete the SOC for Supply Chain Examination for a Software Product

by

Plano, TX – TDi Technologies is excited to announce it is the first company to successfully complete the SOC for Supply Chain examination for a software product.

The examination evaluated ConsoleWorks in the SOC Trust Services categories of Security, Confidentiality and Availability. With this examination, TDi speaks directly to the control and security practices used to create the ConsoleWorks product.

“To my knowledge, TDi’s SOC for Supply Chain report may very well be the first of its kind, certainly the first that we’ve seen issued for a software product,” Ryan Buckner, Principal at Schellman & Company, LLC said. “We expect more adoption of this SOC report as others follow TDi’s lead.”

The examination, formally known as the Report on Controls Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy in a Production, Manufacturing, or Distribution System, affirms TDi Technologies’ commitment to being a secure, trusted partner in its customers’ supply chains.

“As our technology protects and secures critical infrastructure, TDi has to make sure it protects our customers that use our technology,” CEO of TDi Technologies Bill Johnson said. “SOC for Supply Chain was an industry-led effort to define the standards to do that and measure your effectiveness. TDi Scored very well, but we also recognize we have more to do – it’s never done.”

TDi Technologies is the first solution provider to offer a unified system for cybersecurity/operations. Our patented technology provides flexibility, automation, optimization, control and management capabilities that dramatically improve the ability to meet operational and security demands.

We have a diverse, global customer base serving key verticals such as Financial Services, Healthcare, Telecom, Utilities, and Government in both the Tier 1 and Tier 2 markets in North America and Europe. Our solution helps customers reduce operating costs, meet compliance requirements, and improve service delivery.

TDi Technologies’ headquarters are in Plano, Texas. We have been recognized as a high-growth technology company numerous times, receiving the Deloitte Technology Fast 50 award, the Texas Crescent Fast 50, Dallas Business Journal Fast Tech 50, and Tech Titans DFW Technology Fast 50.

Application of OT Ontologies to Protect and Control Access to Grid Assets Preventing Cyber Grid MIS-Operations

by

TDi was awarded a Research and Development contract by DOE to establish a solution that will prevent grid misoperation in both the Utility and Oil & Gas sectors. The objective of this project is to prevent mis-operation by protecting and securing human access to operational assets therefore preventing malicious and inadvertent operational commands leveraging the MITRE ICS ATT&CK framework.

How does this work?
By utilizing the MITRE ICS ATT&CK framework, TDi selected multiple Tactics, Techniques, and Protocols (TTP’s) to build use cases around. The main solution being addressed in this project are:

Extend and enhance ICS ATT&CK framework to include operational TTP’s which can be validated, approved, and automated preventing mis-operation

Improve Commercial industry technology (ConsoleWorks) that provides secure human access which can be captured, interrogated, and validated against operational and adversarial TTP’s defined by MITRE and users of the technology

  • Control and log human access to OT assets
  • Collect and identify current and approved settings of OT Assets
  • Identify, Alarm & Compare human changes to operational technology to prevent human mis-operation
  • Understand & Advise OT Settings as well as configuration changes which define safe operational characteristics and unsafe  changes

How can you benefit?
An actor gains access to Critical Assets and issues commands as they interact with those assets, the solution will intercept and evaluate the risk of the command (or increased risk of the sequence of commands) based on the playbooks that represent the various TTP’s. This will prevent the actor from executing an operational command that could change a configuration in a way that could cause disruptive or destructive events(s) to occur which may result in grid failure, production stoppage, or physical damage to humans and/or machines.

How ConsoleWorks is breaking through barriers and is the new state of the art in Cybersecurity
Currently, the ability to Identify, Protect, Detect, Respond, and Recover, from human actions beyond the HMI or Vendor Application is not available. This approach not only considers the NIST cybersecurity impact of an adversary but enhances coverage to include operational considerations for insiders (vendors, privileged actors, and contractors). It minimizes the need for operations to become cybersecurity experts. By combining known adversarial TTPs with business operational TTPs and automation, our solution shortens the process of Observing, Evaluating, Deciding, and Acting which can prevent mis-operation with minimal human interaction.

TDi Teams Up with IBM | Bringing Integrated IT/OT Cybersecurity to Customers

by

TDi has partnered with the IBM OT Security group to fill a gap in the IBM OT portfolio around Secure Remote Access, Patching, Configuration, and Password Management specific to OT assets that are fundamental to solving these business challenges. IBM brings to the table a very broad set of relationships and access to business opportunities where IBM is being challenged to solve specific operational, compliance, and cybersecurity based problems faced by the market today.

IBM/ConsoleWorks Partnership Customer Benefits:

  • ConsoleWorks allows IBM to bridge the gap between IT and OT as today’s customers are being challenged to support business and regulatory requirements to meet the newfound remote workforce.
  • ConsoleWorks provides a very different level of cybersecurity through operational hygiene by enabling IBM customers to stay up to date on patching when applicable, ensure though granular role-based access that the user is indeed approved to manage a device, or invoke a specific command, and comply with corporate password update processes that meet ever-tightening compliance guidelines.
  • ConsoleWorks’ ability to communicate down to the end devices allows IBM to help its customers standardize and manage asset configurations and notify the correct team when an asset’s configuration is changed without authorization.
  • ConsoleWorks provides a rich ecosystem platform with integration capabilities to ingest data from leading IDM players for expedited onboarding of assets. Once under ConsoleWorks view, ConsoleWorks can provide valuable data back to the SEIM for advanced situational awareness
  • ConsoleWorks provides a platform approach greatly simplifying building the defense posture by minimizing the attack surface through basic operational hygiene….controlling what the human actor can do and logging everything that happens on an asset, greatly reducing the Cyber Attack surface.

Together, the joint partnership offers customers high value while ensuring efficient and streamlined IT/OT operations, compliance, and cybersecurity. Contact us if you would like to know more about this relationship and offerings.

TDi | Founding Member of International Society of Automation (ISA)

by

TDi Technologies recently joined as Founding Member to the ISA. The ISA is a non-profit professional association founded in 1945 to create a better world through automation. ISA advances technical competence by connecting the automation community to achieve operational excellence. The organization develops widely used global standards; certifies industry professionals; provides education and training; publishes books and technical articles; hosts conferences and exhibits; and provides networking and career development programs for its 40,000 members and 400,000 customers around the world.

 

Read Press Release

 

ISA created the ISA Global Cybersecurity Alliance (isa.org/ISAGCA) to advance cybersecurity readiness and awareness in manufacturing and critical infrastructure facilities and processes. The Alliance brings end-user companies, automation and control systems providers, IT infrastructure providers, services providers, system integrators, and other cybersecurity stakeholder organizations together to proactively address growing threats.

ISA owns Automation.com, a leading online publisher of automation-related content, and is the founding sponsor of The Automation Federation (automationfederation.org), an association of non-profit organizations serving as “The Voice of Automation.” Through a wholly-owned subsidiary, ISA bridges the gap between standards and their implementation with the ISA Security Compliance Institute (isasecure.org) and the ISA Wireless Compliance Institute (isa100wci.org).

View Brochure

NSA/CISA Recent Alert | ConsoleWorks Approach to Secure OT Assets

by

ConsoleWorks Staunch Defense to Secure OT Assets

An Alert (AA20-205A) issued by the National Security Agency (NSA) and Cybersecurity and Infrastructure Security (CISA) advises the DoD, NSS, DIB, and U.S. to take immediate action to secure vulnerable, internet-accessible OT assets and Industrial Control Systems.

Click to View PDF of  Complete Alert Report

 

The ConsoleWorks Cybersecurity/Operations Platform provides a staunch defense to secure your critical OT infrastructure. Download the document below to see how ConsoleWorks maps to each of the areas outlined in the NSA/CISA Alert.

ConsoleWorks approach to each of these areas:

  • Threat Tactics
  • Resilience Plan for OT
  • Harden Your Network
  • Create as  Accurate ‘as-operated’ OT Network Map – Immediately
  • Create an Asset Inventory
  • Identify all Communication Protocols Used Across the OT Networks
  • Understand & Evaluate Cyber Risk on ‘as-operated’ OT Assets
  • Implement a Continuous & Vigilant System Monitoring Program

Download – ConsoleWorks Staunch Defense to Secure OT Assets

ConsoleWorks Screenshots

 

NSA/CISA Alert (AA20-205A) – July 23rd 2020

Summary of recent Alert: Cyber actors have demonstrated their continued willingness to conduct malicious cyber activity against critical infrastructure by exploiting internet-accessible OT assets. Due to the increase in adversary capabilities and activity, the criticality to U.S. national security and way of life, and the vulnerability of OT systems, civilian infrastructure makes attractive targets for foreign powers attempting to do harm to U.S. interests or retaliate for perceived U.S. aggression. OT assets are critical to the Department of Defense mission and underpin essential National Security Systems and services, as well as the Defense Industrial Base and other critical infrastructure.

At this time of heightened tensions, it is critical that asset owners and operators of critical infrastructure take the following immediate steps to ensure the resilience and safety of U.S. systems should a time of crisis emerge. The National Security Agency along with the Cybersecurity and Infrastructure Security Agency recommend that all DoD, NSS, DIB, and U.S. critical infrastructure facilities take immediate actions to secure their OT assets.

Internet-accessible OT assets are becoming more prevalent across the 16 U.S. critical infrastructure sectors as companies increase remote operations and monitoring, accommodate a decentralized workforce, and expand outsourcing of key skill areas such as instrumentation and control, OT asset management/maintenance, and in some cases, process operations and maintenance.

Legacy OT assets that were not designed to defend against malicious cyber activities, combined with readily available information that identifies OT assets connected via the internet (e.g., Shodan, Kamerka), are creating a “perfect storm”:

  • Easy access to unsecured assets
  • Use of common, open-source information about devices
  • An extensive list of exploits deployable via common exploit frameworks  (e.g., Metasploit, Core Impact, and Immunity Canvas).

Observed cyber threat activities can be mapped to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) for Industrial Controls Systems framework. It is important to note that while the behavior may not be technically advanced, it is still a serious threat because the potential impact to critical assets is so high.

  • Spearphishing [T1192] to obtain initial access to the organization’s information technology (IT) network before pivoting to the OT network
  • Deployment of commodity ransomware to Encrypt Data for Impact [T1486] on both networks
  • Connecting to Internet Accessible PLCs [T883] requiring no authentication for initial access
  • Utilizing Commonly Used Ports [T885] and Standard Application Layer Protocols [T869] to communicate with controllers and download modified control logic
  • Use of vendor engineering software and Program Downloads [T843]
  • Modifying Control Logic [T833] and Parameters [T836] on PLCs

Click to View PDF of  Complete Alert Report

 

Guest Blog from Nozomi Networks

by

Secure Operational Remote Access for your ‘Work-from-home’ Employees

by  | Jul 7, 2020

As the world sorts itself out during and post-pandemic, one thing is certain – remote working is here to stay. Fortunately, technology can provide the visibility needed to secure operational access, whether employees are working from the office or at home. While this level of flexibility hasn’t been so readily embraced in the past, secure remote access (SRA) is now being widely used to help companies survive and thrive.

 

Secure Remote Access (SRA) is now being widely used to help companies survive and thrive. Visibility into remote connections and activity monitoring is key.

The Problem: Companies Don’t Have Control Over the Home Office Infrastructure

Take for example a 70-year old plant engineer who was considered high risk due to a medical condition, and needed to self-isolate. The company he worked for had to provide secure remote access just for him, so he could get “inside” their facility to manage their critical assets.

The challenge was that by enabling remote access to critical operations assets, the company significantly expanded its attack surface. In fact, according to research from NordVPN, 62 percent of employees are now vulnerable to cyberattacks, thanks to the use of personal computers for remote work during the COVID-19 pandemic.

Another survey found that COVID-19-related phishing emails are on the rise, with many embedding different malware strains as attachments. AgentTesla (45 percent), NetWire (30 percent), and LokiBot (8 percent) were the most actively exploited malware families, said researchers at Singapore-based Group-IB’s Computer Emergency Response Team’s (CERT-GIB). With some minor differences, the goal of all these malware samples is to harvest user credentials from browsers, mail clients and file transfer protocol (FTP) clients, as well as capture screenshots, and secretly track user behavior and send it to cybercriminals’ command and control centers.

“One of the things that have changed is that a corporation no longer has control over the infrastructure its employees are using for work,” said Pam Johnson, Vice President of Customer Experience at Dallas-TX-based solution provider, TDi Technologies. “For example, they’re using personal computers to access the business network. They’re using unsecured WiFi to access operational systems. That’s a fundamental issue that could result in malware making it through from personal computers, going over a home WiFi to the business network.”

“We’re used to knowing who’s touching our critical infrastructure because outsiders have had to sign into a visitor log,” said Bill Johnson, Chief Executive and Founder of TDi. “And when they’re onsite, all the cyber hygiene, cyber protocols, and visitor protocols are being met. They’re not bringing in USBs or laptops from the outside, they’re using equipment contained within the four walls of the business. But with so many remote workers, cyber challenges are added onto the personal and physical-distancing challenges that now exist.”

A big spike in the number of people working from home, and most likely continue to do so, has brought about a change in the micro view of how employees operate and in the macro perspective of how the industry could operate in the future.  The pandemic has forced an industry that’s slow to change even the smallest of details into accepting supporting technology.

“We’ve been delivering remote access to different industries since ’91, and I’ve not found people so eager before. And, not only are they eager to look at secure remote access, they’re coming to us with a shopping list of requirements,” Bill Johnson said. “‘You must be IT-centric or OT-centric, or be able to create a unified view.’ That’s another thing we’re hearing a lot of, ‘I’ve got these other tools, and you have to integrate with those, or you have to be able to allow me to access these other critical tools that I use to manage my business.’ So, the pandemic has led to people becoming more educated about security requirements. In the past, it was a nice-to-have. Now it’s a must-have.”

OT/IoT Security’s Three-Legged Stool

Security was always thought of as a collection of people, processes, and technology, but the latter is now playing a bigger role in allowing businesses to operate via remote access.

“I’ve found that people were often the inhibitor to technology, in that they simply didn’t want to allow technology to be accessible remotely,” Bill Johnson said. “Historically, SCADA technologies and OT technologies haven’t been connected to a network that could be remotely accessed. So, consequently, some organizations default to ‘security by obscurity’. But the COVID-19 pandemic has forced companies to re-think both people and processes.”

While it might be preferable for employees to be physically present, secure remote access technology allows organizations to manage remote access to critical systems in a responsible, secure way, providing situational awareness and auditability to see who is touching the business infrastructure.

The Nozomi Networks / TDi OT and IoT visibility and security solution monitors remote access activity to detect anomalous activity and provides detailed visibility into each remote connection.

Remote Access – The Double-Edged Sword

“Remote access might be the only way right now to keep a business alive and generating revenue, but if you do it incorrectly, you can put the business out of business,” Bill Johnson said. “That’s why the people in the process have always been a blockage. And it’s also why companies are being very specific about the technology capabilities they need to do it right.”

“From a business perspective, we always want to know who, and where are workers coming from,” Bill Johnson said. “What are they doing? How are they doing it? Are they authorized to be here? Show me the log and the audit, and tracking of their remote access.”

Secure Remote Access Best Practices

To help ensure secure operating practices, TDi Technologies’ Chief Executive Bill Johnson and Vice President of Customer Experience Pam Johnson supplied a list of best practices that companies and employees could follow:

Companies

  • Protect everything with firewalls, VPNs and two-factor authentication (basically zero trust).
  • Monitor remote access connections to gain visibility into all remote systems interacting with your network.
  • Make sure standards and policies are in place, including rules for secure servers, and the settings on those servers.
  • Constantly check to make sure those settings haven’t changed.
  • Evaluate how those servers are configured, what software is on them and what version it is, and all automation behind the scenes.
  • Apply patches if it is possible to do so securely from a remote location.
  • Incorporate a regular password update process, using automation.
  • Keep a log of configuration or firmware changes, what was done and by whom.

Employees

  • During remote access, double-check the location you’re going to visit before going there.
  • Don’t click on links and files that are not familiar to you.

View joint solution brief

Nozomi Networks Integrates with Remote Access Management Tools

The Nozomi Networks solution continuously monitors remote access activity to detect anomalous activity before operations are disrupted. It provides detailed visibility into each remote connection, including every system inside the business network that a remote user connects to, the protocols used, network zones or VLANs traversed, and any configuration or firmware changes made to any of those systems.

Our OT and IoT visibility and security solution also integrates with remote access management tools including those provided by our partner TDi, among others. This allows cybersecurity and operations teams to secure almost any type of remote access to their converged OT/IoT environments, including VPNs, terminal servers, jump servers, and clientless remote desktops.

We can help

Reach out today, and we'll talk through how we might be able to help!

Contact us