How Does Microsoft Defender for IoT Fit into Your OT/IoT Environment/Architecture?

Understanding Microsoft Defender for IoT (MDIoT) and its features has been a good start so far. Now, let us delve deeper into understanding how MDIoT can fit into an organization’s network or architecture.

In this chapter, we are going to learn about network sensor placements in various network topologies. We will also learn about Azure Cloud-connected sensors, the Azure portal, and an on-premises management system to aggregate and manage multiple network sensors from a single system.

This chapter will cover the following topics:

• The topology of network architecture
• Diverse ways of traffic mirroring for OT monitoring
• How the Purdue model is applied to MDIoT
• Sensor placement considerations
• OT sensor cloud connection methods

The topology of network architecture

When planning your network monitoring, you must understand your network architecture and how you will need to connect it to MDIoT. It is also important to understand how each of your system elements falls into the Purdue model for industrial control system (ICS) OT network segmentation.

MDIoT network sensors continuously detect and monitor network traffic from IoT and OT devices. To get full coverage for your OT/IoT devices, the network sensor needs to be placed in such a way that it can read all the network traffic. Let us delve into this now.

The most common network topologies in OT/IoT networks

The following are some samples of MDIoT sensor placements for different network topologies:

• Ring topology: In a ring topology network, nodes or switches create a circular data path. Each switch or node device is connected to two others in a circular format. Collectively, the switches or nodes in a ring topology are called ring networks...

Diverse ways of traffic mirroring for OT monitoring

Network sensors, which are a significant part of the MDIoT architecture, receive data or traffic from the following:

• SPAN ports
• The network terminal access point (TAP)

In Figure 5.4, we can see that the OT devices send traffic for analysis through the managed switch with port mirroring:

Figure 5.4 – Example of the network used in an OT environment

We will now learn about different methods used for traffic mirroring in an OT environment to enable monitoring with MDIoT.

To focus on specific and relevant network traffic for traffic analysis, you need to connect MDIoT to a network mirroring port on a switch or a TAP that only covers industrial ICS and SCADA traffic.

SPAN

Port mirroring, commonly known as Switched Port Analyzer (SPAN), is a method of monitoring network traffic. When port mirroring is enabled, the switch sends a copy of all the network packets visible on a single...

How the Purdue model is applied to MDIoT

So far, we have delved into understanding network architectures and their topologies. Now, we will get into details of how the Purdue model (representing the OT network segmentation) in your network architecture links to MDIoT.

Let us learn about the Purdue layers that we covered in the previous chapter, Chapter 4, What Is Microsoft Defender for IoT?, in the context of MDIoT:

Figure 5.9 – The Purdue model with MDIoT

As we can see in Figure 5.9, starting from Layer 0, the layers of the Purdue model pass on information to the layers above them. Layer 0 consists of sensors and actuators, which interact with the physical environment where necessary and pass on the data to the layers above. Layer 1 consists of PLCs and RTUs. The data received from the sensors is further processed in these logical units and they provide adjusted output. Layer 1 also focuses on connecting the hardware of actuators to Layer 2.

Layer...

Sensor placement considerations

Once you understand the target OT network architecture and how the Purdue model applies to it, you may start planning sensor connections in an MDIoT deployment.

Generally, MDIoT is used to monitor traffic from Purdue layers 1 and 2. However, in most modern organizations, OT traffic exists on layer 3 as well; therefore, you can use MDIoT to monitor layer 3 traffic.

Review your OT and ICS network diagram with site engineers to determine the best place to connect to MDIoT to get the most relevant traffic for monitoring. We encourage you to meet with local network and operational teams to clarify your and their expectations. It is a promising idea to create a list of the following information for the target network:

• A list of devices.
• The number of OT networks in the target site.
• The number of devices in the OT network.
• The vendors and industrial protocols in the OT segment.
• Network engineering managers and supporting external...

OT sensor cloud connection methods

In the previous section, we learned about sensor placements. Now, let us move forward to understand how to monitor and maintain MDIoT. Connecting OT sensors to the cloud, and thus to MDIoT, is an important step to consider.

All the methods we are about to mention here emphasize the following:

• Easy deployment: Nothing extra to add to the Azure portal, especially to get the connection between the sensor and MDIoT going
• Enhanced security: No extra resource security needs to be turned on in Azure Virtual Network (Azure VNet)
• Improved scalability: As this is a SaaS-based solution, scalability can easily be achieved
• Flexible connectivity: The connectivity options will be discussed shortly, and you will see that the variety of options provided offers flexibility

Azure proxy

Azure VNet provides you with a proxy, which can aid in the process of connecting OT sensors to the MDIoT portal. The confidentiality of all the communications...

Summary

In this chapter, we have looked at the network topologies supported for MDIoT – that is, the ring and star topologies. While the ring topology creates a circular data path, the star topology is connected to a central hub to transfer the data. We also understood how the Purdue model connects to the MDIoT portal and learned the secure ways of connecting OT sensors to the MDIoT portal.

In the next chapter, we will see how the features of MDIoT help address open security challenges.