Leverages Machine Learning to Identify APT Campaigns Targeting Industrial and Critical Infrastructure Organizations
BOSTON – June 27, 2019 – CyberX, the IoT and industrial control system (ICS) security company, today announced it has enhanced its specialized IoT/ICS threat intelligence capabilities with a new automated threat extraction platform that uses machine learning to identify malware and APT campaigns targeting industrial and critical infrastructure organizations.
Named Ganymede, the new platform is significantly more scalable than traditional threat intelligence approaches that rely on human analysts and manual techniques. And unlike traditional threat intelligence produced by IT security firms, Ganymede is unique in focusing on IoT/ICS/OT-specific threat intelligence for industrial and critical infrastructure organizations. Ganymede also incorporates the industry’s first IoT/ICS/OT-specific malware analysis sandbox.
Ganymede was designed to dramatically reduce the time required to identify, hunt, and eradicate destructive malware such as LockerGoga that has cost industrial organizations tens or hundreds of millions of dollars in lost production and cleanup. Plant safety systems are also being targeted by sophisticated nation-state adversaries across multiple industrial sectors worldwide. Finally, trade secrets, such as proprietary design and manufacturing data, are also being stolen from industrial companies.
How it Works
Developed by Section 52, CyberX’s threat intelligence and security research team, Ganymede continuously ingests massive amounts of data from a range of open and closed sources to deliver the most robust, data-driven analysis possible.
Machine learning and statistical models are used to assign risk scores to specific entities such as files. The risk scores are calculated by machine learning trained on datasets consisting of hundreds of thousands of known good and bad samples. Section 52 threat analysts are used in the final phase to review and correlate the results based on their extensive field experience.
Additionally, suspicious executables are detonated in CyberX’s IoT/ICS Malware Sandbox. Unique in the industry because of its focus on IoT/ICS-focused malware, the CyberX sandbox is a virtualized IoT/ICS environment that analyzes malware activity — using machine learning combined with static and dynamic analysis capabilities — to detect malware access to IoT/ICS-specific objects (processes, libraries, DLLs, ports, etc.). The sandbox then generates a collection of IoCs and representative screenshots of the malware in operation.
Section 52 is composed of world-class domain experts and data scientists who previously staffed a national military CERT defending against daily nation-state cyberattacks. The team is also on-call to perform emergency incident response for clients that have experienced an IoT/ICS compromise.
“Demand for OT security will expand, from traditional preventive approaches to detection, response and predictive capabilities, to be able to react faster to eventual breaches, as well as try to predict their occurrence,” writes Ruggero Contu, Gartner Senior Director Analyst. “The evolution toward more automated security controls will also extend to the OT field, with the integration of threat intelligence and implementation of machine learning and artificial intelligence (AI) supporting analysis and prediction, deception techniques, and orchestration.”1
Operationalizing Threat Intelligence
Actionable threat intelligence is delivered to CyberX clients in several forms, including:
- Threat intelligence updates to CyberX’s network monitoring platform. These automated updates enrich the industrial cybersecurity platform’s built-in, patented IoT/ICS-aware behavioral analytics with the latest threat information.
- IoCs provided with SNORT and Yara rules for enriching clients’ other security tools — such as SIEM and IDS solutions — with Section 52’s threat intelligence data.
- Threat intelligence reports, alerts, and TTPs for CyberX clients, along with expert recommendations and implementation services from the CyberX customer success team to assist clients with threat mitigation.
“Ganymede is a game-changing, data-driven platform for hunting IoT/ICS adversaries on a global scale,” said David Atch, CyberX VP of Research and head of CyberX’s Section 52 threat intelligence team. “It’s a force multiplier for both our clients and ourselves, which will continue to evolve as it ingests more and more data from environments worldwide.”
[1] Gartner, “Competitive Landscape: Operational Technology Security,” by Ruggero Contu, 29 October 2018
About CyberX
CyberX delivers the only industrial cybersecurity platform built by blue-team experts with a track record of defending critical national infrastructure. That difference is the foundation for the most widely deployed platform for continuously reducing IoT and ICS risk and preventing costly production outages, safety failures, environmental incidents, and theft of sensitive intellectual property.
Notable CyberX customers include 2 of the top 5 US energy providers; a top 5 global pharmaceutical company; a top 5 US chemical company; and national electric and gas utilities across Europe and Asia-Pacific. Strategic partners include industry leaders such as Palo Alto Networks, IBM Security, Splunk, Optiv Security, McAfee, DXC Technology, and Deutsche-Telekom/T-Systems. For more information visit CyberX.io or follow @CyberX_Labs.
For more information visit CyberX.io or follow @CyberX_Labs.
Media Contact: Deb Montner, Montner Tech PR, 203-984-7861, [email protected]
The post CyberX Enhances Industrial Threat Intelligence with Automated Threat Extraction Platform appeared first on CyberX.