2019 ICS Cyber Security Conference | USA

Network visibility provides situational awareness in an Industrial Control System (ICS). The use of physical network TAPs or SPAN ports to provide information to an out-of-band monitoring solution is critical to increasing the security posture of an ICS network. However, as more ICS vendors incorporate virtual machines (VMs) into their designs, an additional layer of tapping is necessary to ensure no blind spots are present. Communication between VMs can provide an opportunity for malicious actors to remain undetected, due to traditional tapping methods not being able to see the traffic.

One solution to capture inter-VM communication is the use of Virtual Network TAPs. This software solution monitors traffic flows between VMs and mirrors the traffic to be forwarded to security tools for analysis. The presentation will cover how Virtual Network TAPs can be installed on a typical ICS network which uses virtualization, what are typical capabilities of Virtual Network TAPs, and ways the data can be used if your project has a limited cybersecurity budget. Increased hardware virtualization is on the horizon and being able to setup and use Virtual Network TAPs will ensure your control system can be monitored effectively.