Multispectral sensor helps minimise risks in IoT and OT environments

A new multi-spectrum sensor developed specifically for Internet of Things (IoT) and Operational Technology (OT) environments wants to increase visibility over devices that until now were only detected when connected to wired networks, monitoring various wireless frequencies, not just Bluetooth and Wi-Fi.

Guardian Air, from Nozomi Networks, can detect assets connected to wireless networks to immediately identify unauthorised installations. It does this by monitoring frequencies used by various technologies, such as Bluetooth, Wi-Fi, cellular, LoRaWAN, Zigbee, GPS, radio frequencies used by drones, WirelessHART, among others.

In this way, it can help to stop threats to wireless networks that use, for example, brute force attacks, forgery and bluejacking techniques that send unsolicited messages via Bluetooth, including determining the location from which the attacks come.

Data from Guardian Air sensors is sent to a Nozomi Networks system in the cloud for analysis, which will provide a holistic view of IoT and OT environments.

According to Danielle VanZandt, industry research manager for commercial and public security at Frost & Sullivan, organisations across a wide range of industries now rely on billions of wireless devices to speed up their operations, from smart manufacturing to digital medicine, or from building automation to oilfield production. The new Guardian Air gives IT security professionals and OT operators the visibility they need to gain tight control over risk management and response activities on wireless networks.

According to Nozomi Networks, wireless communication is intrinsically vulnerable to illegal interception, espionage, Man-in-the-Middle attacks and a host of other cybersecurity risks. “Wireless technologies are fundamentally changing the way industrial organisations operate. Unfortunately, they also greatly expand the attack surface. Guardian Air solves this problem by giving customers the visibility they need into wireless environments to help minimise risk while maximising resilience,” says Andrea Carcano, co-founder and chief product officer at Nozomi Networks.

According to a report by Nozomi Networks itself, during the first half of 2023, malware activity in IoT and OT environments around the world grew 10-fold, affecting a wide variety of use cases and sectors of activity. Threat activity related to access controls more than doubled. Authentication and problematic password hygiene topped the list of critical alerts for the second consecutive reporting period, although activity in this category decreased by 22 per cent compared to the previous reporting period.

“There is good news and bad news in this report. A significant drop in activity per customer in categories such as authentication and password problems and suspicious or unexpected behaviour on networks suggests that efforts to protect systems in these areas may be paying off. On the other hand, malware activity has increased dramatically, reflecting a growing threat landscape. It’s time to ‘step on the gas’ to strengthen defences,” says Chris Grove, director of cybersecurity strategy at Nozomi Networks.

Malicious IoT botnets also remained active, continuing to use standard credentials in attempts to access IoT devices. From January to June 2023, Nozomi Networks found:

• An average of 813 unique attacks per day; the day with the most attacks was 1 May, with 1,342 attacks;
• The main IP addresses of the attackers were associated with China, the United States, South Korea, Taiwan and India;
• Brute force attempts remain a popular technique for gaining access to systems; default credentials are one of the main ways used by attackers in IoT environments;

To help defend IoT and OT environments, the Guardian Air sensor will be available in the second quarter through Nozomi Networks and its global network of partners.