What Is Microsoft Defender for IoT?

Microsoft Defender for IoT (MDIoT) empowers IT and OT teams to identify critical vulnerabilities and detect threats using behavioral analytics along with Machine Learning (ML) that is IT/OT aware. All this happens while also ensuring that performance and availability are not compromised.

It provides a centralized interface to manage the threats and vulnerabilities affecting the ever-increasing attack surface in the IoT/OT world.

MDIoT also provides network-layer monitoring that is agentless and can integrate seamlessly with industrial equipment from various vendors and SOC tools.

In this chapter, we will cover the following topics:

• The IoT and OT environments
• The role of asset inventory
• Risk and vulnerability management
• Continuous threat monitoring
• Operational efficiency
• MDIoT benefits

The IoT and OT environments

Figure 4.1 is a diagrammatic representation of IoT and OT environments in organizations, which might then be connected to an IoT hub for the further processing of data. Azure IoT Hub receives data from both OT and Enterprise IoT (EIoT) environments, as depicted in the following figure:

Figure 4.1 – Representation of IoT and OT environments

Let us look into agentless device inventory. The issue that the industry is trying to solve is keeping OT/IoT devices up to date, but in reality, they are unpatched, and IT teams have no insight into the status of the devices, whether they are patched or not. Additionally, these OT/IoT devices do not support agents. It is, hence, important to understand specialized protocols used by IoT/OT devices and machine-to-machine behaviors to be able to use agentless monitoring using MDIoT. Thus, it provides security and visibility into the organization’s network.

A centralized portal can...

Risk and vulnerability management

Awareness of the risks and vulnerabilities present in customers’ OT/ICS networks may help them to plan and mitigate the associated risk.

An OT network with many assets and sensors that are successfully tracked and inventoried in the asset discovery needs to be analyzed for any vulnerabilities. Ideally, any vulnerabilities also need to be remediated before they are exploited by an attacker. The block diagram in Figure 4.6 depicts assets’ vulnerabilities being remediated:

Figure 4.6 – Vulnerability management for assets in the IoT/OT industry

Some of the techniques used by MDIoT for learning vulnerabilities include Deep Packet Inspection (DPI), Threat Intelligence (TI), Artificial Intelligence (AI), and ML.

MDIoT helps the IT team identify unpatched assets, device configuration issues, unauthorized applications, top attack vectors, open ports, unauthorized connections, and missing anti-virus and then...

Continuous threat monitoring

Microsoft’s Section 52, the MDIoT security research group, is a team of passionate OT threat researchers, nation-state defenders, and data scientists. The team does OT/IoT threat hunting, malware reverse engineering, protocol search, and OT cyber-incident response. The information provided by threat intelligence (TI) feeds helps in identifying threats in the IoT/OT industry and thus aiding in stopping adversaries from exploiting vulnerabilities. The TI is pushed to the MDIoT cloud-connected sensors at regular intervals; offline sensors need to be updated at a regular frequency.

Recognizing targeted attacks and malware by leveraging threat-hunting tools and behavioral-aware analytics by scanning through historical network traffic and Packet Captures (PCAPs) is done continuously. This is a key feature of MDIoT as it will flag an alert if an attacker is trying to make unauthorized changes in endpoints, assets, or sensors. So, we (the SOC team) are...

Operational efficiency

MDIoT is built from the ground up for OT security. It sends real-time alerts about device misconfigurations and malfunctions. This is an additional capability on top of the cybersecurity benefits. This capability helps the OT operations team to identify and carry out root cause analysis by flagging abnormal activities and providing full details that are needed from the OT segment and for any operational issues that may impact plant availability or product quality.

In Figure 4.10, an operational alert is highlighted to show that MDIoT is capable of recognizing misconfigurations. This functionality aids in increasing operational efficiency as admins are able to employ the necessary remediation steps:

Figure 4.10 – Screenshot of an operational alert aiding in operational efficiency

We will get into the details regarding understanding the alerts in the coming chapters.

At the end of this section, we now clearly understand the...

MDIoT benefits

MDIoT leverages passive monitoring and Network Traffic Analysis (NTA). This is the highlight of the product as it combines passive monitoring and NTA with Microsoft’s own patented technology (i.e., IoT/OT-based behavioral analytics) to capture information in real time.

To capture network traffic, we need to deploy a sensor on-premises to a network SPAN port, and we shall now see some of the advantages of this.

Zero impact on network performance

Most OT environments cannot sustain an active scan. Figure 4.11 represents the fears of a plant operating team about downtime caused by an active scan:

Figure 4.11 – Active scanning OT devices may cause downtime

Downtime directly translates to a loss of business or profit, which is a central cause of worry for most organizations. MDIoT is here to help as it leverages passive scanning of network traffic. The huge advantage of this is that the device being scanned will not be actively...

Summary

In this chapter, we have successfully introduced MDIoT and delved into its capabilities and features. Some of the highlights are asset discovery, risk and vulnerability management, continuous threat monitoring, and operational efficiency. We have seen its benefits, including passive scanning, quick deployment, and advanced threat detection. We will look at many of these in the next few chapters, so get ready! In the very next chapter, we will understand how MDIoT addresses the security gaps through risk assessment, continuous threat monitoring, and more, along with the steps required to deploy MDIoT.