The international vendor of critical smart grid devices also operates an installed fleet of tens of thousands of edge devices worldwide – making it directly responsible for their availability and functionality in daily operations.
This was a particularly exciting case for our support team. Thanks to the anomaly reports from our intrusion detection systems running on the edge devices, we were able to save the manufacturer and operator of the devices from high costs due to customer complaints and claims, as well as from the time-consuming search for a needle in a haystack.
Initial situation and challenges
Solution
Endpoint Detection & Response
- continuously monitors the edge devices’ behaviors,
- identifies, analyzes and reports cyber attacks and error states in real time,
- provides optional fleet protection against critical events via automated security policies.
Containerized IIoT security monitoring
- allows for fast and low-footprint integration on controls of globally distributed edge devices,
- enables cost-efficient maintenance of security solution,
- enables security monitoring on edge devices with limited resources.
Implementation and insights
The operation of the security monitoring of Rhebo IIoT Security is provided as a managed service by the Rhebo support team. During the evaluation of various metrics, Rhebo noticed that the security monitoring agents on several dozen edge devices in the fleet were repeatedly restarting.
Together with the vendor, the specific devices were examined via the control platform of the edge devices. As it turned out, the trigger for the monitoring agent restarts was that the edge devices themselves were repeatedly restarted. As a result, the devices were not optimally available and usable for customers of the smart grid. These restarts weren’t detected before on the control platform itself due to specific metric settings and a fleet of several tens of thousands of devices. They were lost in the noise.
Thanks to the security monitoring, the malfunctioning devices were detected and localized quickly. The vendor was able to examine the devices in a targeted manner and eliminate the error.
Results
- REAL-TIME ALERT OF TECHNICAL MALFUNCTIONING through continuous monitoring of the device communication.
- PINPOINT LOCALIZATION OF MALFUNCTIONING DEVICES through agent-based deployment directly on the edge devices.
- BRIDGING THE PREVAILING SKILLS GAP with security monitoring as managed services by Rhebo.
Text taken over from original – Rhebo
