How Do the Microsoft Defender for IoT Features Help in Addressing Open Challenges?

We have seen in earlier chapters some of the challenges in securing organizations that follow Industry 4.0 standards. These organizations reap the benefits of Industry 4.0 and the automation it brings forth, and forget to consider the security aspect.

In this chapter, we will focus on the areas that an IoT/OT organization might overlook when it comes to ensuring security and the impact this could have. At the end of this chapter, we will also learn about sensor installation, which is a starting step in your practical journey to MDIoT.

We will cover the following topics in this chapter:

• Missing asset inventory for IoT/OT devices
• Risk and vulnerability management
• Continuous IoT/OT threat monitoring, incident response, and threat intelligence
• The installation of the MDIoT service

Missing asset inventory for IoT/OT devices

When the assets of organizations are not tracked regularly and the organization does not know whether they are on the factory floor or in the manufacturing unit, this hampers productivity and leads to not-so-desirable business outcomes.

Organizations should place great emphasis on identifying what is in their network and the management of assets, including the current inventory of their business and software assets. The key to an effective cybersecurity strategy is making IT/OT asset management a priority. Most organizations, IT/OT teams, and cybersecurity teams struggle to understand what is in their network (assets), what is present on the device (what type of data it has, access to and from the device, and device criticality), who owns it (owners and users), and where the assets are located geographically and logically.

The following are some examples to put into perspective the havoc a missing asset inventory can create:

...

Risk and vulnerability management

Now that we know about the importance of an asset inventory, we need to talk about risks and vulnerabilities impacting OT/IoT assets. Common questions we hear from Chief Information Security Officers (CISOs) and business teams are, What are the risks for our crown jewels, that is, OT/IoT assets? What are the mitigation priorities for critical assets?

In most OT/IoT environments, a vulnerability assessment is done on a fixed frequency (once a year or once every 6 months). This does not provide a real-time risk status for OT/IoT assets and overall business risk at any given point in time.

The MDIoT risk assessment report may help you here. The risk assessment report is a comprehensive vulnerability assessment report generated by MDIoT, based on network analytics using deep packet inspection, various behavioral modeling engines, and SCADA-specific state machine design. The good news is this is not a point-in-time truth; it is always current.

...

Continuous IoT/OT threat monitoring, incident response, and threat intelligence

IoT/OT threat intelligence and behavioral analysis are used to keep an eye out for unusual or unauthorized behavior. By immediately identifying unwanted remote access and rogue or compromised devices, you may improve IoT/OT zero-trust security. You can view traffic history, look up real-time alerts, and scan for risks quickly. You can also identify current dangers such as zero-day malware and survival techniques that static signs of compromise fail to pick up on. For more analysis, look into full-fidelity packet captures (PCAPs).

For a given device profile, normal behavior is determined by establishing communication flows as baselines and understanding the systems it communicates with. With this understanding, policies can be aligned with a zero-trust framework that limits device communications to required systems and nothing else.

Continuous monitoring also helps organizations to be resilient in...

The installation of the MDIoT service

This is what is required for you to get started with MDIoT:

• A Microsoft Azure subscription and account
• Owner or Contributor access to the Azure subscription

For the test lab setup, you could configure all the roles and services with the global admin account itself. But if this is being planned on a production tenant, you might want to consider leveraging a role such as security reader, security admin, security contributor, or subscription owner to establish a separation of duties.

It would be wise to also consider the availability (i.e., traffic from all European regions is routed through West Europe, and all other regions are routed through the East US regional data center) of all the regions that MDIoT and the Azure IoT hub are available in and whether your data residency covers the region as specified in the compliance policy of your organization or the residing country.

The following are things to keep in mind when...

Summary

In this chapter, we have touched upon some of the important features of MDIoT and seen how it can help address open challenges by addressing the asset inventory, risk and vulnerability management, and continuous threat monitoring. We have also learned how to install the MDIoT sensor and seen it populating the dashboard with data.

It is now time for us to understand what the data we have collected so far can do for us as an organization and how these threat insights can save the day. We will look at this in the next chapter by understanding asset inventory. Asset inventory is a critical part of the OT/IoT cybersecurity landscape, and we will delve deeper into it next.