Learn how Industrial Defender enabled a large electric and gas utility to unify their OT architecture for enhanced security monitoring and put in place network intrusion detection in order to monitor suspicious network activity.
The client is a European multinational electricity and gas utility company providing the transmission and distribution of power. Its principal activities span multiple countries with an annual revenue in the tens of billions.
Since 2009, the client has been using Industrial Defender products and services. The client deploys Industrial Defender Central Manager (IDCM) along with Industrial Defender Collectors to monitor their critical assets and control system networks for natural gas and electricity supply.
Monitoring Events and Network Activity – The client has a variety of Linux and Windows end points and get lots of valid authentication events, but they intentionally don’t want to filter some of these valid events. One example is valid log ins that occur when certain users log in as the privileged user. The Industrial Defender solution allows them to easily see if anyone is abusing or misusing this privilege. Using Industrial Defender's Event Search, they can quickly and easily find any event irregularities.
Network Alerting and Easy Issue Investigation – On a few occasions, the client had issues that suggested they were under attack. In one case, they were alerted of unusual network activity of a certain traffic type, and they started an investigation. They used Industrial Defender's Events Search extensively to correlate the sequence of the events. After investigating the network activity details valid log ins to certain machines, and related hardware events, they concluded that a vendor was using a USB stick that had not been scanned for viruses. At that point, the client told the Industrial Defender engineer, “Your solution just paid for itself.”
