Loading
Rockwell Automation Home
  • Industries
    • Industries Chevron RightChevron Right
      • Automotive & Tire
      • Cement
      • Chemical
      • Entertainment
      • Fibers & Textiles
      • Food & Beverage
      • Household & Personal Care
      • Infrastructure
      • Life Sciences
      • Marine
      • Metals
      • Mining
      • Oil & Gas
      • Power Generation
      • Print & Publishing
      • Pulp & Paper
      • Semiconductor
      • Water Wastewater
      • View All
    Industries
    Case StudyRockwell Automation's case studies Case Studies DistributorDistributor How to Buy EventEvent Events
  • Capabilities
    • Capabilities Chevron RightChevron Right
      • The Connected Enterprise®
      • Consulting & Integration Services
      • Cybersecurity
      • Digital Transformation
      • Industrial Analytics
      • Industrial Automation & Control
      • Industrial Maintenance & Support
      • Industrial Networks
      • Lifecycle Services
      • Machine & Equipment Builders
      • MES Solutions
      • Process Solutions
      • Safety Solutions
      • View All
    Capabilities
    Blogs DistributorDistributor How to Buy EventEvent Events
  • Products
    • Hardware Chevron RightChevron Right
    • Software Chevron RightChevron Right
      • Circuit & Load Protection
      • Condition Monitoring
      • Connection Devices
      • Distributed Control Systems
      • Drives & Motors
      • Energy Monitoring
      • Human Machine Interface
      • Independent Cart Technology
      • Industrial Computers & Monitors
      • Input/Output Modules
      • Industrial Control Products
      • Lighting Control
      • Motion Control
      • Motor Control
      • Networks Security & Infrastructure
      • Packaged Solutions
      • Power Supplies
      • Programmable Controllers
      • Push Buttons & Signaling Devices
      • Relays & Timers
      • Safety Instrumented Systems
      • Safety Products
      • Sensors & Switches
      • Signal Interface
      • View All Hardware Products
    • DesignSuite
      • Dynamic Digital Twin Software
      • Studio 5000 Design Software
    • OperationSuite
      • FactoryTalk Edge Gateway
      • FactoryTalk Batch
      • FactoryTalk Historian
      • FactoryTalk View - HMI Software
      • FactoryTalk Metrics
    • MaintenanceSuite
      • FactoryTalk Analytics for Devices
      • FactoryTalk AssetCentre
      • FactoryTalk Emonitor
      • FactoryTalk Network Manager
      • FactoryTalk TeamONE
      • Fiix CMMS
    • InnovationSuite
      • Augmented Reality
      • FactoryTalk Analytics
      • MES
      • ThingWorx IIoT Platform
    Products
    Find Products by Our Brands: Allen-Bradley FactoryTalk
  • Support
    • Product Support Chevron RightChevron Right
    • Documentation Chevron RightChevron Right
    • Knowledgebase Chevron RightChevron Right
    • Training Chevron RightChevron Right
    • Downloads
      • 2D & 3D Drawings
      • Activations
      • Add-on Profiles
      • Application Code Libraries
      • Compatibility & Downloads
      • Drivers & Firmware
      • Electronic Datasheets
      • EPLAN Macros
      • Sample Code Library
      • Software Patches
      • View All
    • Selection & Configuration
      • Control Systems Configuration Tools
      • Procurement Specifications
      • ProposalWorks Proposal Builder
      • Global Short-circuit Current Ratings Tool
      • Integrated Architecture Builder
      • View All
    • Compatibility & Migration
      • Migration & Modernization
      • Lifecycle Status
      • Product Replacement Lookup
      • View All
      • Technical Documentation Center
      • Technical Specifications
      • Product Certifications
      • Product Drawings
      • Release Notes
      • Literature Library
    • Support Center
      • Support Options
      • Search for Answers
      • Chat Online
      • Call Us
      • View All
    • Online Forum
      • My Inbox
      • My Favorites
      • My Subscriptions
      • View All
    • My TechConnect
      • Chat History
      • Service Ticket History
      • Manage Your Favorite Answers
      • Field Service Request
      • View All
      • E-Learning Courses
      • Training Workstations
      • Training Calendar
      • View All
    Support
    Contact Us HelpHelp Get Support LaunchpadTools and applications View All Tools
  • Company
    • Events Chevron RightChevron Right
    • News Chevron RightChevron Right
    • Careers Chevron RightChevron Right
    • PartnerNetwork Chevron RightChevron Right
    • About Us Chevron RightChevron Right
    • Featured Events
      • Automation Fair
      • Process Solutions User Group
      • Smart Machine Workshops
      • VirtualConnect: Smart Manufacturing
      • View All
    • Webinars
      • Live
      • On-Demand
      • View All
      • Blogs
      • Case Studies
      • Automation Today
      • Podcasts
      • Press Releases
      • Media Contacts
      • View All
      • View Jobs
      • Teams & People
      • Hackathon
      • Employee Video Spotlight
      • Authorized Distributors
      • Encompass Product Partners
      • Licensed Developers
      • OEM Partners
      • Strategic Alliance Partners
      • System Integrator Partners
      • PartnerNetwork Portal
      • View All
      • Our Brands
      • Our Community
      • Our History
      • Integrity & Sustainability
      • Investor Relations
      • View All
    Company
    ProductivityProductivity Investor Relations
  • Sales
  • Sales
  • View All Industries
  • View All
  • View All
  • View All
  • View All
  • Automotive & Tire
  • Cement
  • Chemical
  • Entertainment
  • Fibers & Textiles
  • Food & Beverage
  • Household & Personal Care
  • Infrastructure
  • Life Sciences
  • Marine
  • Metals
  • Mining
  • Oil & Gas
  • Power Generation
  • Print & Publishing
  • Pulp & Paper
  • Semiconductor
  • Water Wastewater
  • View All
  • The Connected Enterprise®
  • Consulting & Integration Services
  • Cybersecurity
  • Digital Transformation
  • Industrial Analytics
  • Industrial Automation & Control
  • Industrial Maintenance & Support
  • Industrial Networks
  • Lifecycle Services
  • Machine & Equipment Builders
  • MES Solutions
  • Process Solutions
  • Safety Solutions
  • View All
  • Circuit & Load Protection
  • Condition Monitoring
  • Connection Devices
  • Distributed Control Systems
  • Drives & Motors
  • Energy Monitoring
  • Human Machine Interface
  • Industrial Computers & Monitors
  • Input/Output Modules
  • Industrial Control Products
  • Lighting Control
  • Motion Control
  • Motor Control
  • Networks Security & Infrastructure
  • Packaged Solutions
  • Power Supplies
  • Programmable Controllers
  • Push Buttons & Signaling Devices
  • Relays & Timers
  • Safety Instrumented Systems
  • Safety Products
  • Sensors & Switches
  • Signal Interface
  • View All Hardware Products
  • View All
  • View All
  • Technical Documentation Center
  • Technical Specifications
  • Product Certifications
  • Product Drawings
  • Release Notes
  • Literature Library
  • View All
  • Training Workstations
  • Training Calendar
  • View All
  • View All
  • Blogs
  • Automation Today
  • Podcasts
  • Media Contacts
  • View All
  • View Jobs
  • View All
  • Authorized Distributors
  • Encompass Product Partners
  • Licensed Developers
  • OEM Partners
  • System Integrator Partners
  • PartnerNetwork Portal
  • View All
  • Our Brands
  • Our History
  • Investor Relations
  • View All
  • iTRAK Intelligent Track Systems
  • MagneMover Lite Intelligent Conveyor System
  • QuickStick Intelligent Conveyor System
  • View All
  • Dynamic Digital Twin Software
  • Studio 5000 Design Software
  • FactoryTalk Edge Gateway
  • FactoryTalk Batch
  • FactoryTalk Historian
  • FactoryTalk View - HMI Software
  • FactoryTalk Metrics
  • FactoryTalk Analytics for Devices
  • FactoryTalk AssetCentre
  • FactoryTalk Emonitor
  • FactoryTalk Network Manager
  • FactoryTalk TeamONE
  • Fiix CMMS
  • Augmented Reality
  • FactoryTalk Analytics
  • MES
  • ThingWorx IIoT Platform
  • 2D & 3D Drawings
  • Activations
  • Add-on Profiles
  • Application Code Libraries
  • Compatibility & Downloads
  • Drivers & Firmware
  • Electronic Datasheets
  • EPLAN Macros
  • Sample Code Library
  • Software Patches
  • View All
  • Control Systems Configuration Tools
  • Procurement Specifications
  • ProposalWorks Proposal Builder
  • Global Short-circuit Current Ratings Tool
  • Integrated Architecture Builder
  • View All
  • Migration & Modernization
  • Lifecycle Status
  • Product Replacement Lookup
  • View All
  • Support Options
  • Search for Answers
  • Chat Online
  • Call Us
  • View All
  • My Inbox
  • My Favorites
  • My Subscriptions
  • View All
  • Chat History
  • Service Ticket History
  • Manage Your Favorite Answers
  • Field Service Request
  • View All
  • My Training
  • View All
  • Automation Fair
  • Process Solutions User Group
  • Smart Machine Workshops
  • VirtualConnect: Smart Manufacturing
  • View All
  • Live
  • On-Demand
  • View All
  • Digital Transformation at Norbord
  • View All
  • Brighter, More Flexible Tower Light Now Available from Rockwell Automation
  • Delphi Award Received For Asset Management
  • Internal Bypass Expands Smart Motor Functionality
  • New IaaS Bundle Eases Industrial Networking
  • Rockwell Automation Names Sebastien Grau as Regional Sales Director for Middle East, Turkey and Sub Saharan Africa
  • Expanded Power Range for PowerFlex 6000 MV Drives
  • Studio 5000 Software Update Optimizes Productivity
  • FLEX 5000 I/O Modules Bring Greater Productivity and Flexibility to a Connected Enterprise
  • New Cable-Pull Switch Enhances Industrial Safety
  • Instant Industrial Device Analytics
  • Rockwell Automation to name Al Ghandi Electrical & Automation as Authorised Distributor in the UAE
  • Rockwell Automation to Broaden Connected Enterprise Consulting Expertise with Acquisition of Kalypso
  • Single-Control Multi-Well Pad Solution Cuts Costs
  • Advanced Light Curtain System Improves Flexibility and Safety
  • Automation University
  • Rockwell Automation to Showcase the ConnectedProduction Solutions and Premieres its ThinManager Software at ADIPEC 2018
  • Safe Torque Off Option Simplifies Machine Design
  • Machine Performance Analytics Bring OEM Expertise Into Producer’s Digital Environment
  • Software-Powered Connected Services
  • New Managing Director of Rockwell Automation for Sub-Saharan Africa announced
  • Rockwell Automation Simplifies Analytics for Industrial Productivity
  • New Managing Director of Rockwell Automation for Sub-Saharan Africa announced
  • Securely Deploy Cloud and Mobile Technologies with New Network Guidance
  • Rockwell Automation drive system selected for Sumitomo Rubber’s rubber mixers
  • PlantPAx DCS Roadmap
  • View All
  • Students & New Grads
  • View All
  • Hackathon Use Case for Manufacturing Optimization
  • Hackathon Use Case for Sustainability
  • Hackathon Use Case for Visual System Modernization
  • Hackathon Use Case for Dynamic Filtering
  • View All
  • 24toCode Event Recap - Winter 2019
  • 24toCode Event Recap // IT Internal Hackathon
  • Meet the 2019 IT Summer Interns
  • 24toCode Promo Video
  • Harbor View Plaza Ribbon Cutting
  • Check Your Blind Spots Mobile Tour at Rockwell Automation
  • Mechanic & Tool Apprenticeship at Rockwell Automation
  • Working at Rockwell Automation in Karlsruhe
  • Summer Internships at Rockwell Automation
  • The Intrapreneurial Skills Accelerator at Rockwell Automation
  • Makers Wanted
  • #LifeatROK w Katowicach
  • IT Summer Internship Program
  • #LifeatROK with Diogo
  • View All
  • Cisco
  • Endress+Hauser
  • FANUC
  • Microsoft
  • Panduit
  • View All
  • Our Focused Giving
  • STEM Education
  • Lifelong Learning
  • View All
  • Sustainability Report
  • Our Commitment to Diversity, Equity and Inclusion
  • Environmental, Health, & Safety
  • Ethics & Compliance
  • Global Supply Chain & Sourcing
  • Product Environmental Compliance
  • Quality Management Systems
  • Trust & Security
  • Workforce of Tomorrow
  • View All
Case StudyRockwell Automation's case studies Case Studies DistributorDistributor How to Buy EventEvent Events
Blogs DistributorDistributor How to Buy EventEvent Events
Find Products by Our Brands:
Allen-Bradley FactoryTalk
Contact Us HelpHelp Get Support LaunchpadTools and applications View All Tools
ProductivityProductivity Investor Relations
  • Literature LibraryLiterature Library
    Literature Library

    Access technical and commercial publications for hardware and software products, applications, services and solutions.

    PCDCProduct Compatibility and Download Center
    Compatibility & Downloads

    Find downloads including firmware, release notes, associated software, drivers, tools and utilities.

    KnowledgebaseKnowledgebase Support Center
    Knowledgebase

    Browse the database of questions and answers on a variety of products and technologies.

    Product ConfiguratorProduct Configurator
    Product Configurator

    Configure and select products rapidly.

    Software SubscriptionsSoftware Subscriptions
    Software Subscriptions

    One stop shopping for software and subscription services.

    2D & 3D Drawings Bill of Materials CrossWorks Electronic Datasheets Motion Analyzer My Equipment My Training E-Learning Portal Product Lifecycle Status Product Registration Product Selection Toolbox Repairs Sample Code Library Software Activations View All
    Tools
    UserUser Sign In/Create an Account
  • User Account User
Tools
Literature LibraryLiterature Library
Literature Library
PCDCProduct Compatibility and Download Center
Compatibility & Downloads
KnowledgebaseKnowledgebase Support Center
Knowledgebase
Product ConfiguratorProduct Configurator
Product Configurator
Software SubscriptionsSoftware Subscriptions
Software Subscriptions
2D & 3D Drawings Bill of Materials CrossWorks Electronic Datasheets Motion Analyzer My Equipment My Training E-Learning Portal Product Lifecycle Status Product Registration Product Selection Toolbox Repairs Sample Code Library Software Activations View All
Blog | Cybersecurity
Recent ActivityRecent Activity

Protect Your Operations with Proactive Threat Hunting

Share This:

LinkedInLinkedIn
TwitterTwitter
FacebookFacebook
PrintPrint
EmailEmail
Main Image

You have a strong industrial security program in place. You’ve cleaned up with good cyber hygiene and have implemented intrusion detection systems to avoid future incidents. But in the complex world of cybersecurity, you can’t stop there.

Despite all your efforts, latent advanced persistent threats (APTs) are still a concern. They are slowly at work trying to find chinks in your armor and exfiltrate data, bogging down your operations. And intrusion detection isn’t going to catch this activity.

The Facility of the Future eBook
Main Image
eBook
The Facility of the Future eBook

Does your facility operate at its full potential? Download the eBook to learn how to deploy smart, fast, and flexible Life Sciences facilities.

Download Now
You’re Ready for Threat Hunting

Threat hunting is one of the next logical steps in your cybersecurity program. In its simplest form, you are searching the network for external threats or intrusions that went undetected by automated security systems. It is a very scalable exercise and can be done with varying degrees of automation, including none at all.

It can not only further protect your proprietary recipes and information, but it also has great potential for improving operational efficiencies as well. While this practice isn’t entirely new to the IT space, it is making its way into OT environments. And this is where beverage and food production or life sciences operations can benefit the most.

Threat hunting is proactive, and takes a step back from the scanning tools, traps and future-focused infrastructure already in place. In an age of technology, it uses gray matter to uncover malicious activity and infiltrations that have been hiding in your network for months, maybe years. And further, it can find correlations not otherwise detectable between network activity and production inefficiencies.

Infestations Wreaking Havoc in Unexpected Ways

Have you noticed your mixer acting up? Are HMIs locking down? A label printer flashing errors?

It can start with an operator charging their unprotected phone in an open USB port on the network. Months later, your oven starts acting up and won’t maintain set parameters, even though mechanically, there’s nothing wrong.

Careful review of network logs uncovers that each time the oven acts up, there are beacons going to an outside IP address. This correlation is otherwise undetectable, and is what makes the human factor critical, and threat hunting so valuable. 

I went into a plant once that was experiencing repeated network slowdowns on a certain shift. Proactive hunting led to the discovery that one employee’s workstation was running an undetected Bit Torrent. So, each day when they logged in at the beginning of their shift, the entire network was impacted.

Published 02 March 2020

Why Aren’t Intrusion Detection Systems Catching All of This Hidden Malware?

Most of what threat hunting uncovers appears innocent, and without context and correlation, passes detection systems as business as usual. A piece of malware can communicate with an unknown IP address, but will look similar to intended internet traffic.

There also could be SYN scans going on in the peripheral, outside the boundaries of what your industrial security software is looking for. They sit quietly and slowly look for a hole in the network. They’re not getting refused and haven’t established outside connections yet, so they remain undetectable.

In a threat hunting exercise, you may discover that an outbound connection is coming from a process that shouldn’t be going out to the internet. Or you may find a system that wasn’t being used at the time the communication was made, indicating an infected source.

The thing is, these APTs were probably already there when you implemented your cybersecurity system. That’s because most intrusion detection and prevention programs rely on a known, good state. If the baseline it starts from has poor traffic or malware activity, it becomes part of the norm. Many publicized security breaches have fit into this category. It is only years after a breach occurred that it’s detected and the scope off the damage realized.

Smart Manufacturing eBook
Main Image
Brochure
Smart Manufacturing eBook

How smart manufacturing can help improve yield, productivity, and efficiency in food and beverage operations.

Download Now
Getting Started

The good news is, you likely have what you need to get started. Threat hunting is easy to implement with the right partner and can be a one-time activity, or become part of an ongoing industrial security program. Your HMIs and servers are already creating activity logs you can gather and analyze offline so there’s no stress on the network or production interruptions.

So stop relying solely on endpoint protection and virus scanners to detect if you’re vulnerable. Go hunting for infiltrations before they impact your plant floor.

Published 02 March 2020


Subscribe

Subscribe to Rockwell Automation and receive the latest news, thought leadership and information directly to your inbox.

Subscribe

Recommended For You

Loading
  • Technical Question
  • Chat Technical Support
  • Phone Support
  • Contact Sales
  • General Questions
  1. Chevron LeftChevron Left Home Chevron RightChevron Right
  2. Chevron LeftChevron Left Company Chevron RightChevron Right
  3. Chevron LeftChevron Left News Chevron RightChevron Right
  4. Chevron LeftChevron Left Blogs Chevron RightChevron Right
Discover
  • The Connected Enterprise®
  • Create Your Account
  • Case Studies
  • Events
Information for...
  • Distributors
  • OEM
  • System Integrators
  • Encompass Partners
  • Investors
  • Career Seekers
Contact Us
  • General Questions
  • Technical Questions
  • Local Sales & Service
  • Pricing & Availability
  • Report Ethical Concerns
  • Customer Experience Survey
Site Information
  • Legal
  • Privacy Policy
  • Cookie Preferences
  • Terms of Use
  • Trademarks
Change Country Site SelectionChange RockwellAutomation.com site selection to a different country, region or language Change Country
South Africa/English

Keep Updated With Us

Sign up to receive our latest headlines for free.

Stay Informed Now
Follow Us
BlogRockwell Automation's Blog
Copyright ©2021 Rockwell Automation, Inc.
Home