Protect Your Operations with Proactive Threat Hunting

Infestations Wreaking Havoc in Unexpected Ways

Have you noticed your mixer acting up? Are HMIs locking down? A label printer flashing errors?

It can start with an operator charging their unprotected phone in an open USB port on the network. Months later, your oven starts acting up and won’t maintain set parameters, even though mechanically, there’s nothing wrong.

Careful review of network logs uncovers that each time the oven acts up, there are beacons going to an outside IP address. This correlation is otherwise undetectable, and is what makes the human factor critical, and threat hunting so valuable. 

I went into a plant once that was experiencing repeated network slowdowns on a certain shift. Proactive hunting led to the discovery that one employee’s workstation was running an undetected Bit Torrent. So, each day when they logged in at the beginning of their shift, the entire network was impacted.

Getting Started

The good news is, you likely have what you need to get started. Threat hunting is easy to implement with the right partner and can be a one-time activity, or become part of an ongoing industrial security program. Your HMIs and servers are already creating activity logs you can gather and analyze offline so there’s no stress on the network or production interruptions.

So stop relying solely on endpoint protection and virus scanners to detect if you’re vulnerable. Go hunting for infiltrations before they impact your plant floor.