Vulnerability Management and Threat Monitoring

In the previous chapters, we started learning about the core features of MDIoT. Let us continue in that spirit and move on to learning about risk and vulnerability management along with threat monitoring.

Risk management in IoT/OT incorporates identifying, analyzing, and controlling threats aimed at an organization’s IoT/OT security. We learned about the challenges of cybersecurity in Industry 4.0 in Chapter 1, and we have to ensure that the risks are known to the management and are assessed with risk mitigation steps in place.

Risk assessment forms an integral part of MDIoT. The most vulnerable devices, variations from the baselines, remediation priorities based on a secure score, network security risks, illegal traffic by firewall rules, connections to Industrial Control System (ICS) networks, internet connections, access points, industrial malware, indicators, unauthorized assets, weak firewall rules, network operations...

Risk assessment

Risk assessment provides you with a roadmap that will tell you what to protect and how to protect it. The ever-growing number of IoT or OT devices is increasing the security risks of organizations. Since an OT or IoT environment lacks modern controls such as auto-patching or a strong password (no default password), it becomes imperative that MDIoT should be leveraged, as it can instantly discover unknown vulnerabilities.

This understanding of vulnerabilities can be achieved by generating a risk assessment report. Figure 9.1 shows the Risk assessment section in the MDIoT sensor portal. Click the Generate report tab:

Figure 9.1 – Risk assessment in the sensor portal

When you click on a generated report, you will see the downloaded file, as shown in Figure 9.2:

Figure 9.2 – Downloading the risk assessment report

Let us move on to understanding what this report provides. Figure 9.3 depicts the overall security...

Summary

In conclusion, we have learned about the various ways in which MDIoT aids in identifying threat/attack vectors and vulnerabilities. We have gotten a deeper understanding of the risk assessment report, which, in turn, shines a light on the security score of various devices and provides guidance toward mitigating them as well. To further increase usability and resourcefulness, we looked at the vulnerabilities highlighted in an Azure workbook as well, which aids in creating custom reports that can come in handy for your investigations. Use all of these to stay on top of your assets and devices, and secure them to thwart any attacks coming your way.

In the next chapter, we will explore Enterprise IoT (EIoT), integrating MDIoT with security information and event management (SIEM) solutions such as Microsoft Sentinel (cloud-native SIEM), and the zero-trust approach regarding the IoT/OT industry.