1. Skybox for IoT Jason Smith – Channel Technical Director EMEA
03/07/2018
Skybox for IoT
Updated: October 9, 2017
Jason Smith – Channel Technical Director EMEA

2. Challenges in IoT Limited visibility
Non–actionable intelligence and data silos
Untrusted device sprawl
Here’s a stat from the Verizon Data Breach Investigations Report that illustrates why we’re needed: 97 percent of breaches are avoidable through standard controls
If that’s the case, it means companies have the capability, at least on paper, to avoid breaches (and the bad press and loss of customer trust, etc. that comes with them)
But they aren’t using the tools they have effectively. Why?
Limited visibility of the attack surface: they don’t have insight to what it is they’re trying to protect, what threats are putting them at risk and what tools are their disposal to deal with these issues
Non–actionable intelligence and data silos: for all the tools and investments put into cybersecurity, it can be all for not if that data from point solutions or feeds can’t be extracted and contextualized with information from the rest of the internal environment and, externally, what’s going on in the current threat landscape
And lack of resources: manually trying to stitch this data together is essentially impossible on an enterprise scale and isn’t the best use of your human resources — who are increasingly hard to find. So a lot of time and resources and budget are wasted on tasks that really should be automated so your team can focus on more strategic action

3. To explain what Skybox does, a good analogy is that of driving a car
To explain what Skybox does, a good analogy is that of driving a car. How long do you spend looking in the rear view mirror when you drive? 5% of the time? 10%? You spend most of your time looking forward, right? Well the IT Security industry has spent 90% of it’s time looking in the rear view mirror at what’s behind it, rather than looking forwards at what’s coming. Spending all your time looking at what has already happened, through SEIM or IDS or log management solutions will help you work out what you should have been doing already, rather than what the next steps should be. Looking backwards is not the best tactic when it comes to driving – you’ll be guaranteed to crash at some point – nor is it the best tactic when it comes to cyber security. That’s where Skybox can help.

4. Model the Attack Surface
DMZ
To have a successful security program, you need to be able to look at all the pieces together — not just firewalls, not just vulnerabilities, but how they relate to one another.
So what are those pieces:
Security controls: firewalls, IPSs, VPNs
Network topology: routers, load balancers, switches
Assets: servers, workstations and networks — including cloud, virtual and industrial networks as well as traditional IT
Vulnerabilities: location and criticality
Threats and their attack paths: hackers, insiders, worms
Security Controls
Network Topology
Assets/IoT
Vulnerabilities
Threats

5. Skybox Security Suite Integrated Security Management
Total visibility of the attack surface
Traditional IT
Virtual and cloud
Operational technology
IoT
Vulnerabilities and threats
Built for large, complex networks
One platform, many solutions
Our product suite: the Skybox Security Suite
Providing a common platform for integrated security management
Rooted in providing total visibility of the attack surface
Seamless visibility across traditional IT, virtual and cloud and OT environments like ICS and SCADA systems
Layered on top of that is vulnerability data and threat intelligence to give you contextual understanding of where your biggest risks lie based on your environment and the threat landscape
From its inception, our modules were built for large, enterprise–scale, complex networks
Scalability has never been an issue
And these aren’t just point products.
While modules can be purchased separately, the advantage is that they’re built on a common platform that understands the “other side of the coin” giving you better context to address security across the board and not in disconnected compartments
Because your network doesn’t work like a series of silos.
Your security teams need to move beyond looking at it that way
And attackers have certainly moved beyond looking at it that way

6. Skybox Security Suite Integrated Security Management
Vulnerability and Threat Management
Vulnerability prioritization aligned to the current threat landscape
Exposed and exploited vulnerabilities highlighted
Resources directed where they’re needed most
Our vulnerability and threat management solutions
Align vulnerability prioritization with what’s going on in the current threat landscape
Highlight vulnerabilities exposed in your network and actively being exploited in the wild
And help you to direct resources where they’re needed most, focusing on imminent threats to your organization, so efforts aren’t wasted on false positives, irrelevant or low–level risks

7. Skybox Security Suite Integrated Security Management
Security Policy Management
Easy, efficient compliance reporting
Intelligent workflows and automation
Proactive risk assessments of security and network changes
On the security policy management side our solutions provide:
Easy and efficient compliance reporting, including out–of–the–box reporting for many industry and government standard and that can be customized for unique internal policies
Intelligent workflows and automation to free up staff to focus on more strategic tasks
And proactive risk assessments of security and network changes, looking not just for security gaps, risky access or compliance violations but vulnerability exposures as well

8. Security in Multi-Cloud Environments
AWS
Azure
NSX (Private)
Complete Visibility
End–to–end path analysis
Policy compliance across networks in a single dashboard view
Most enterprises are working with multi–cloud networks, that is with multiple cloud service providers, a mix of public and private clouds and their own on–prem virtual environments.
What Skybox is helping them to do is extend the security management capabilities they rely on in their physical network to their virtual and cloud networks.
And that all starts with complete visibility
It needs to be seamless
It needs to be built in one model so it can be analyzed together
With this visibility from Skybox via the model you can:
Analyze paths end to end, across networks or within a cloud environment
Consistently apply policies and analyze compliance in a single dashboard view
Assess how you’re meeting regulatory compliance like PCI with out–of–the–box checks
And manage vulnerabilities in virtual and cloud networks as well as physical environments with complete context, including intelligence on the current threat landscape
This way, you don’t have to treat security management in the cloud as a separate entity than your traditional IT network. You are responsible for security of your data in the cloud, so you need means to manage it efficiently and holistically with the rest of the network.
Out–of–the–box regulatory compliance checks
Threat–centric vulnerability management

9. Security in Industrial Networks
IT Business/ Corporate Network
OT Production Control System Network
Internet
RTU/PLC/DCS Controller Units & Field Devices
Neighboring Utilities
Visibility and path analysis for combined IT and OT networks
Risk analysis
Util E
Util A
Vulnerability detection
Skybox is extending visibility and analysis to industrial networks encompassing operational technology like ICS and SCADA systems. The reason that’s important is because the barrier between the IT and OT network over the years has been disappearing. OT networks are rife with legacy technology that can’t translate or interact with the security controls of your IT networks. So you need to understand how that affects to your security status and make sure proper surrounding controls are in place.
You can see how an attack might play out in this SCADA system diagram:
The attacker gains access to the corporate network
It gains access to the control system LAN
Through discovery, it now understands the process and can then gain control of the process
What Skybox can help you do is model this OT environment alongside your IT network so that you can visualize how they’re connected and analyze the paths between them. This gives you a better contextual understanding:
Of your risk
How attacks could play out in your organization
And the ability to detect and prioritize vulnerabilities with complete context
Util B
Util C
Util D

11. Thank you