How can i industry sign banking rhode island pdf secure
hello and welcome to the webinar titled today is cybersecurity trust no one securing third-party connections to the industrial industrial control systems well housekeeping before we begin thank you all for joining us I want to make sure that everyone can hear me properly the webinar has officially started if you cannot hear me speaking please check to make sure your computer mute button is turn to off please you can log off and log back in if you're having a problem and if you still cannot hear me please click the Q&A box on your screen to contact tech support and an engineer will assist you some functionality of the portal here the chat box that enables us all to have a side conversation if we'd like during the presentation and if you'd like to ask a question of our expert presenter today please use that button with the question mark that enables you to submit a question to us and I will present that to Scott so good afternoon my name is Chris McNamara I am director of content with smart industry today I'm serving as a contributing moderator with control global and our expert speaker Scott Coleman Scott is the director of marketing and product management with Howell cyber defense hello Scott good morning or good afternoon I guess depending where you are I think we are good to go I'll pass these controls over you Scott and you can take it away all right thanks Chris so good day everybody today we're going to be talking about third-party isolated controls and securing the industrial control system networks and thinking about those third parties that connect to the networks most of them have legitimate reasons and then we're going to look at how the DHS recommends defending against unwanted intrusions that may be created in supporting those third parties that need to access or networks we'll move right into that so if you think about control systems in how they were deployed in the past you had plants that were very isolated folks from a physical perspective and from a networking perspective and the things that were important were safety reliability and system resiliency as we move forward with the digital world right we have a lot more connectivity there providing expert information both for those working inside the facility and outside the facility the problem with that is that you know we're focused on automation and efficiency or management but each of those connections really becomes a potential threat and so the department homeland security has come out with some recommendations saying how do we reduce those threats how do we protect ourselves and what do we look at to do that so if you look at your your facility and you think about those entities those parties that need access so you've got potentially maybe you're pushing something out to the cloud you've got suppliers providing equipment updates you have software vendors you know sending in patches that may need to be implemented means you've got contractors or third parties a disaster recovery solution just general logistics for planning operations you want to do some remote monitoring and you've got third parties that have service level agreements that need to be met in order to maintain the equipment that's operating inside the plan so these are all legitimate reasons in entities that need connectivity the problem is each of those connections there could potentially become a cyber threat against the network the you see the quote there from the US Department of Energy so with trusted networks remote access mobile devices vendors and supply chains become the most likely route of attacks basically and what they're saying is in similar to what happened in Sony what happen at Target is it's those third parties that you're not thinking about as a potential cyber threat or attack vector which may become that vulnerability need to be aware of so clearly there's a lot of different kinds of companies and applications that are used today to get information in and out of the network you've got different applications with different functions doing different things you have historians in other types of applications they need to get information in and out and then you've got standard things like OPC and Modbus and those kinds of applications again in order to improve the functionality operational aspects of the plant or the facility you need connectivity and you need information to be shared from the facility out to those surrounding third parties so what can we do you know what do we want to do this to mitigate those threats we need to enable those data flows the data still needs to get out to those third parties to meet your SaaS or whatever else you have in place with those entities but nevertheless you want to be secure you want that plan to the facility to be secure so do we need to do so if we turn to the Department of Homeland Security they've actually issued a white paper stating you know seven strategies for defending industrial control systems and if we look at a couple of those you just pull out three or four of those and look at those little deeper one of the first things they recommend is reducing or eliminating the number of connections in other networks so just by reducing unneeded connections you're going to reduce your potential threat vectors into the network secondly you want to convert two-way connections to one-way connections out of the plant so how do you get data to those folks outside of your plant to convert to a connections that are coming in to your plant to again to a one-way connection and then for those remaining connections that has to be two-way that maybe can't convert to a one-way how do you secure those and what do you do so we're going to go through each of those and look at them a little bit deeper in terms of what's happening as you think about the different types of connectivity and entities are connecting and you think about the Internet of Things if you think about the industrial Internet of Things anything about IT note' convergence all those things are building and creating lots and lots of connection points lots of sensor data information needs to be monitored but each of those is making a hole in your network right each of those has a is penetrated your perimeter defense and it's created a potential threat vector and you think about people talking about firewalls and pin holes right well for data they definitely care how big that pin hole is or isn't is a way in so pin holes really don't protect your network so let's look at ways to eliminate as many of those pin holes as possible and while still being able to share the data it's necessary to run your plant in your operations okay so so did you start out in a first step is well what do I actually have out there what's lalume I connected to what are the reasons for connecting to me what kind of information do they need to do their jobs and what do I need to share with us so you sort of do that audit you map your networks you find those external connection points and then determine who had access to what and then determine what's necessary so once you've done that once you've done that assessment you see your network gets a lot cleaner you remove those extraneous connections that don't need to be there and now you've got a much cleaner looking environment and now you think about how do I consolidate anything that was redundant did I get make sure I removed all the unneeded stuff anything that's unauthorized of course you want to remove and then establishing least privileged account access so people are only accessing things that they need to only get into those segments of your network to portions of your network that are necessary for them to do what they do and not extend it into other things so next step and what you would have as a cleaner network so we we've got is the remaining legitimate connections at this point now the problem is we've still got two-way connections right so each of these guys because that's the way the world operates today everyone thinks about two-way connections I send you data that you get my data great thank you very much I'm gonna send you some more data to get my data and that kind of we'll think a little bit later about what we do in terms of moving to one-week connections and how that works but at this point you've cleaned up your network but you still got a lot of Thule connections we've still got a lot of vulnerabilities there that we need to address we've got there the first step yes this is Chris let me jump in here we have a question from Charles Hoffman he asks are you designing a pinhole protocol and a ports so yes I mean sort of all of the above it basically if you think about a firewall in what it does it's loading rattle traffic from the outside through to the inside and as we move to a one-way connection we'll be looking at completely closing that pin home basically no traffic whatsoever we'll be moving through those those pinholes so it I'm using it a little liberally in terms of in any basically open opening our connection in through an external perimeter into something internal that you want protected great thanks sure so the next step or the first step you know that we've done our audit you've gotten rid of stuff that we don't need and now we're going to start to convert one way convert the two-way connections that we have remaining to one weak connection we think about how many of those connections can we make as a one-way out push so maybe someone has to come in and find out how long a system has been in operation how many hours of services have been you know operating what is the flow rate of something so all legitimate pieces of information but instead of having you reach into my network that I want to secure and protect why don't I just push that data to you describe to me what you need in terms of data to do the functionality of performing the operation that you need to and I'm going to push that data at you on a creative one way pass out and I'm going to push that data to you you get what you need to do your job and now I've eliminated one of those threat vectors into my network so if we go back to our circle oops going back to our circle so some of those blue two-way connections have now been turned into green one way connections so I've identified all those places where always I'm going to just do one remote monitoring right they just need syslog information for me or send data from me that describes what's happening to the equipment or the system inside the plant and so they keep tabs on what's happening now but they're doing remote monitoring we sort of call that remote monitoring without remote access there's a lot of different tool sets that you can can get your dream report comes to mind where they have these nice dashboards that shows what's happening inside the plant and they need data obviously to populate those dashboards but as you're doing that how do I get that data out to an application like that so you we've tested the solutions with that and you just push that data out and you don't request it so that's the rid of the concept here is I'll push the data to you you populate your solution and now you're reflecting what's happening operationally inside the plan so remote access a remote monitoring excuse me without remote access and of course the same kind of information there's many sort of third parties that provide so the oh you know om providing equipment for inside the plants but they need to know what's going on and we do the same thing in those environments where we provide information pushing up so what we see here is is some of those two-way connections have been converted to one-way pushes of data and I reduced my threat vector like footprint against which someone could good good mount an attack against me so now if we look at the the two-way connections into the network so maybe I got some software I need to do a patch on one of my machines and get it up to date so d again the DHS recommends you should make that a one-way only transaction so you validate verify or authenticate to that software that needs to be pushed into the plant once you've validated it with a hash some something along those lines then you go ahead and authorize it and push that that file in or that update it you verify the diseth entik that's from the original and then you push it in and that's the only thing it does there's no way there's no two-way communication again you're preventing that connection becoming from becoming a threat vector and allowing someone to leverage it and attack the network so if we look back to our network here of entities third parties that are connecting we've now getting rid of the two weigh-ins and that's now one way in and that leaves us with one of the blue lines it's still a two-way so in this case you know that's when we can't get rid of right so what the DHS says here is hey you know what if I've got if I've got a two-way connection that I absolutely have to have and we all know those exists it's probably the only use case where you don't have that is like nuclear power plants where they've completely isolated and they're truly one way out only but I do have a remaining two-way connection that I'd like to use and you need to use the recommendation is to lock that down close any unused pores limit the community control connections what was actually going to occur on there and then now you've got your intrusion detection systems you've got all the other threat mitigation threat analysis that those resources but you can now apply to this connection and let's be realistic and maybe there's three or four of these but instead of having five 10 15 25 connections all in that they've got a monitor and do my intrusion detection and all those other levels of security against now I've converted to one only out so one weighs in and now we've got a very much smaller a much smaller group of two-way connections that I can put resources apply resources to to make sure that those threats are mitigated and I'm watching very strictly against what's happening there so if we go back to our circle right at this point I basically modified all of my connections to either be one way out one way in or a single connection heavily managed and monitored so that my - wait can remaining - a connections or a fewer number and B I can put a lot of resources against us to make sure that there doing what I need to and people aren't using those new ways of are inappropriate so we talked about doing one way out and one way in and then reducing that to late traffic and how do you do that so the approach that is supported and recommended by the department - idiot Department of Homeland Security is a data diode so then some of you may or may not be familiar with data diodes and what they do a data diode is based on hardware so if you think about other security measures most of them all of them are software based so they have got some kind of configuration that is restricting flows or trying to restrict access the basis for a data diet is that it's Hardware secured so what that prevents is vulnerabilities that they're due to now where the limited management because once you've configured it to operate you don't need to be updating it with signatures and modifications or those kind of things so becomes it kind of sounds audacious to say that it's unhackable but you end up with a solution because of the physics because of the hardware underlying how a diode works you can't actually modify it you cannot get around the physical layer security that's inherent in a data diode attacks that are against software based solutions either take advantage of some kind of vulnerability that's in their stolen credentials Mallos now we're there and there's this management that has to be occur on a regular basis to keep them up to date and keep them secure so I'm just going to walk through real quick here what a diode is how it works and how it can work in a 2/8 environment so if you think of a one-way data valve where data can only move in one direction that's really good a data diode water can only go one through a valve in one direction and you've got data can only move to a gated diode and wonder affection it can scale up it's used a segment and in protect sensitive networks anything
ehind it can't be reached and you've got a physical layer there that's enabling hardware and forced one-way only transfer how this works in the two-way world is one of those think questions that we get all the time people say ok I get that I get that it's one way I get that the inherent security of a diode the physical nature of it prevents people from getting in but how does that work in a way where all my networks are two ways you know with the exception of some things like syslog where's a UDP push you know that's clearly a use case where this is obvious how that would work but if I if I have a tcp/ip connection how is that going to work across the diode so to explain that what we have is a proxy on either side save the source side and so this is the side where degenerate the information that is important to me or I need to share is generated okay so whether that's you know again it could be a syslog information it could be a historian a that could be the output of a particular you know of a turbine or whatever it is that information is being sent to the destination today what occurs is the source side of the data diode has a proxy and it terminates the tcp/ip session now could also terminate a Modbus session it could terminate an OPC session it could you know terminate a PI historic location session whatever it is either at the transport layer or at the application layer it'll terminate that session so the data is sent to the diode the diode becomes the new endpoint so radius Li a was talking to B or sources talking to destination the source side of the i/o becomes the new you know B prime if you will so a talking to D prime instead of the original big the session is terminated so all tcp/ip the acknowledgments the acts and acts and all those things that are expected the protocol are all followed and executed what we then strip out the actual payload because at the end of the day is the date it's the payload that is important to the end user of the other side pull that payload out we actually use ATM if you're familiar with a with the protocol asynchronous transfer mode that was really developed by the phone companies for high bandwidth voice and data we use ATM across the platform the payload is is stuck into an ATM cell transported across or across we're talking you know inches and then on the other side so none of the IP address information on the Mac information so none of the routing information is ever traverses the the data diode gets to the other side at that point there is basically a table that says any incoming traffic on ATM you know channel XYZ is actually mapped to destination B and it was by the way this is a tcp/ip session so therefore it creates a new tcp/ip session loads that payload in there and says hey since it's on its way and gets out to destination B so what you have is on the source side you have a tcp/ip connection to a normal protocol doing all the things that it wants to do sending information receiving information the payload gets pulled out sends across no routing information nothing else about well what is what is the content so that it sent across or the source network is sent across it's pulled back out put back into its original protocol and send on this way so therefore the original a the original B they're still talking they're two-way communications to a protocols and you've got a one-way transfer in the middle moving data across there's a couple other things that are happening there so you've got a protocol break because you're converting what was TCP tcp/ip in this example to ATM and then back to tcp/ip again on the other side so you're actually breaking that protocol the source side has absolutely no idea where it's actually sending they dated to on the B side because there's a configuration table as they in this incoming traffic it's put on this ATM channel and that's all it knows my source goes on this channel and on the receive side this incoming Chan gets placed onto this outbound tcp/ip session so he has no idea what the original source was and the source ID has absolutely no idea what the destination is that can't be changed so say you had some malware that got introduced inside the facility you know somebody walked in with a thumb drive and you know innocently or not or whatever they came in they needed to put some software on the inside in unintentionally some malware gets released inside the plant now a lot of that stuff will phone home and ask hey what do you want me to do what do I do across the diode because there's no routing information there's no routing across the platform itself there's no way for that device to ever phone home first it would have to spoof itself and pretend to be one of the white listed access points or sources of information it would have to replicate the appropriate protocol as being news or monitored on that inbound leg and then even it did all that it would then be sent across and it was actually no way of controlling where it goes on the other side so basically at that point it dies because it's no way to reach it designated or intended recipient on the other side because there's no way to direct where things are going so you've got is a built-in solution that's breaking the connections not routing anything and not allowing envy on the inside to ever communicate to something on the outside unless it's been configured ahead of time so the source side is configured by one illustrator completely separate from the source the destination side configured by another channel totally isolated and campy but allows that traffic that payload to get moved to Frost without any tread vectors in so it's physically impossible to come in through the receive side and get into the source side and it's really preventing things on the inside that are bad from getting out out of the network and potentially doing to another damage okay so primary use cases we touched on a little bit but you want to push data don't let people reach into your network you want to do remote monitoring so this is the alarms event basically any kind of file email notifications so we have people with diodes working in you know and they just want to get that information out of the datacenter that if the drive is failed or sometimes equipment is failed without a possibility of something getting back into that datacenter software updates we talked about getting those patches in updates other than the other kind of executables but you're doing your due diligence on the file itself before it gets transferred in and then you have the protocol breaks you have the non routing capabilities all those protections are built in even for your one way in and then you've got your standalone two-way connection where you want to maybe do some remote command and control and we've heard this many times we'll be out at conferences etc and folks will say I guess it again - one way I get the one way in but I've got this one application and where I've got a substation that's out in the middle nowhere and I don't want to roll a truck to get out there so how can I get in and and so this the privately managed two way connection is really how that's how that solved okay so let's go look at some of these use cases so in this case I've got a in a shipping environment I've got information on a cargo ship that needs to get sent out so maybe I've got you know I'm saying that drive systems and PLC's controlling steerage and all those kinds of things on the ship I collect the information in historian I've got maintenance data maybe I just a general database is manifest or something of what's you know my cargo that information all has to get out to the vendors the logistics guys are going back up and go trucks and haul the stuff off and go wherever its ultimate destination is I got third parties that need to do maintenance on the on the ship while it's in port etc so all good data that needs to go out in third parties for good reasons but you want to make sure that no one is coming in and accessing any of the information on the ship or of the systems on the ship and doing something or planting something that would prevent or maybe influence or affect operations of normal operations of the ship you know maybe two days ten days out of port when they're actually back underway so there's a other cues there if we look at a land-based solution really the same kinds of things you maybe you want to replicate a gin light screen to a third you know party or remote monitoring center maybe you know it needs to be Modbus or OPC kinds of traffic or data it really doesn't matter because as we said before it could be at the transport layer you know as tcp/ip or UDP or FTP or it can be at the application layer where you're sending things across in the new proxy so it's the implementation in the functionality are the same you just have to be aware of what kind of data and how you need to get it out and with the protocols our next use case this is the one we talked a little bit about moving patches in so you see here is I've got my trusted vendor out there so this is maybe noe a maybe it's just Microsoft you know I got my pcs or my laptops inside the plan or facilities I need to get my latest patch to you download that patch independently you get a hash from them certifying a verifying this is the authentic file you build a manifest it says these are the files I want to transfer across and here's the hash code for those particular files the system will run checks against that it can run checks against file extensions file types do ASCII checks with a variety of checks that can be won and there's really the operator to decide what they do and don't need to check on a particular file once that file has been verified that it's a allowed to go frost it will transfer across the diode and then be ready on the inside for whatever it needs to be done if it doesn't pass the checks then it's quarantined or automatically deleted it's really up to the administrator to decide what to do but in this way you've got a one way in only and you're betting that file before it ever crosses the threshold into that environment the next use case this is really the two-way connection so in this scenario what we actually have is two diodes going one in each direction the analogy like to use so that is the security run into at the airport so I'm at the airport I'm checking they check my ID they check my ticket they scan my bags to scan me I come in and I'm now in the terminal I fly wherever I go and then when it land I don't try and go back out that same inbound Lane I go through a different Lane that's for passengers arriving and typically there's a physical guard sitting there there's a line on the bottom on the floor and once you cross that line you can't go back in so two one-way pass completely independent completely autonomous or nothing about each other but as a passenger I've been able to make a round-trip basically is what happening with this solution you've got you're allowing a tcp/ip connection to be make a roundtrip it's being verified it's being limited you can only initiate that from the inside out so the connection would not be able to be initiated from outside the facility and then only a spare specific traffic thread is allowed through single port and your weight listing and locking down all the potential things that you're connected to that's really this is use case and that's really in the situation where it's more than just a piece of data or an update that I need to get ie it's not just a piece of file or a piece of data or an update I actually have to essentially manipulate something on the inside and that's where this comes into play where I can make this connection so I've got my diode I still doing the protocol breaks I'm still not pushing any routable information across I'm not exposing any IP address or any of that information it's different than a file because in a firewall of course you're opening up a connection it's still routable connection and whatever traffic goes across that goes across it but here we're still doing the protocol break the outside can't see the inside the inside can through the outside nothing routable traverses and it's just payload moving back and forth the other thing I'm going to keep in mind is you know with all the benefits of what you get from a one way out one way in and then a lock down two ways the defense-in-depth no notion never goes away right you still need to think about your firewalls using antivirus role based access controls multi-user authentication none of that goes away you want to continue because you still have insider threats you still have some of those two-way connections etc you may have connections that you're unaware of you know that that slipped your purview about value when you're doing your audit of internal of all your connectivity so the other things that are being done don't go away but we do do now is you've tried to eliminate as much of those threat vectors as possible and reduce your possible methods and access points coming into a network whatever does the greatest extent possible god let me jump in there Jared online in a question here I think is possible this coming from Corey regarding one way out communication if a thread actor is dedicated enough to get malicious code inside the ICS for example of physical access wouldn't it also be expected for the threat actor to be able to intercept messages a third party system is receiving and Rob communication from there just thoughts about that sure so I soon core adapting in a two-way solution probably not in a one-way solution probably best a third scenario but one way is just one we have to do so if it's one way out and so let me just describe a little bit more detail of it about the data diode so the data diode on the source side has a LED basically that's sending light that both the data actually is traversing a fiber-optic cable and on the outside of the receiving the sends are the destination side there's a photo receiver that's receiving the light so you have to defeat the physics of that to ever send light in the opposite direction if you're talking one way out if that's the question I think that's the answer okay okay has amazed dance here with meaning sort of things maybe it's also from the red side of the diode out to the third party now there is there's methodologies we do encryption so you could potentially encrypt end to end and there's things like that could that can also be layered on without getting into a ton of detail on exactly all the features of what's capable there but there is capabilities of doing encryption and other methods to ensure that the data in transit is also protected so that may be that goes to answering Corey's question also okay and while we have a little aside here I'll ask another question here posed by Charles Hoffman yes how do you handle RDP sessions to servers in a DMZ so we work with quite a few customers that have DMVs existing and we typically will fit right with the fire wolves are today so if you're protecting a plant and then you transition into a DMZ and then maybe you come out and you're going to a sock or you're maybe just going to your regular IT network or whatever it is whatever is on the other side of the DMZ we would sit at the edge of that DMV as much the same way a firewall would sit there that is typically where the solution sits is right at the edge of that DMZ okay it's not we have a couple other questions coming in here but up we're nearing the end of your deck so let's finish that and then we can open up a full round of Q&A sure yeah I just said one it was really just a summary slide that really talks about mapping your networks limiting those unnecessary connections and then doing the conversion through one way out one way in and then for any remaining two-way connections locking those down per DHS recommendations single IP adjust single port that's opened and then Hiva we managed back that one connection but we can go straight to we can go straight to questions now if we want to okay I will let me do a little housekeeping here I'll let you catch your breath Scott that was excellent advance to this slide here just a couple items here on the left side of your screen you'll see some handouts that a
e available there's a white paper seven steps to defend industrial control system that is similar to the presentation that's got a this afternoon there's also a deck of the actual presentation slides that we just saw you can download those piece of content there there's also a PDF with details about the 2018 smart industry conference it's our fourth annual conference this is a little plug for smart industry side a7 up in September in Chicagoland and obviously cybersecurity is the main focus of our conference each year so I invite you to check that out and find the discounts in there we're at the Q&A section right now so I would like to really open this up to a full discussion please do submit questions via the question box there on your screen and I will process them and I will pose them to Scott Scott you ready to field some new questions coming in ready to go okay this comes from Daniel he asks why would someone use a bi-directional day diode solution instead of a firewall sure so it's really it's some of the things I've laid out before but instead of letting opening a port a pinhole you know however you want to characterize it in allowing a flow back and forth to it what you've done with a bilateral is now you a byte or bi-directional solution is you've limited who can initiate that session so you can only initiate from the inside and not the outside right so you're not allowing people just to say hey I want to talk to something on the inside it's got to be initiate from the outside so the outside person needs to be the recipient not the initiator you're putting in your conversions from your native protocol across the protocol break the other side you are hiding the IP information from the inside the network so there's a bunch of different things that are going on that are offering much more protection than a firewall and in fact if you're familiar with rapid7 they do pen tration testing they've actually done extensive testing on the product and proving that it is in fact more secure than a firewall so if anybody's interested you know we can make the summary of those tests available to folks so they can understand you know in depth you know what was tested how it works and what it prevents okay let me take a break here and alert the listeners accessing the webinar on demand in the future you too can ask questions I'll Scott a via the question back there we will get those questions provided to him and provide you an answer via email so please do post questions if you're listening on demand question it's got a question I had for you our most clients aware of the data diode approach when you present that or is it a new concept that they haven't heard of but they don't really know much about sure it really did it really depends sometimes we go to conferences and you know there's people that have heard of it and what we're seeing really recently is there is definitely a growing awareness that the data that would exist I mean they're not new they've been around for 20 plus years initially you know used by the government agencies Intel agencies etc moved into critical infrastructure really in 2008-2009 with nuclear taking the lead there early adopters denman to oil and gas and now you looked across many many industries but but still you know easily more than 50% of the people that we run into in a day to day basis you know they're interested but our cyber security focused I've never heard of them so we are still having to educate folks and what they do and how they work but we are starting to see them there's a you know automate a car standard now for for data diodes and how they might work in autonomous vehicles so you're seeing a wider breadth of access and you know we get folks coming to the website that are in the you know winemaking business is in the food and Bev's businesses and gun manufacturing right so it really covers the gamut in terms of folks that are now starting to look at them and exam and roll them out so so it's still there's still a lot of education that's going on but it's starting to move and a question from Kevin what are the weaknesses of data diodes so tell me that the biggest weakness or the hurdle to get over is folks thinking ok this is a niche thing that only works for this you know specific environment or that kind of thing and that you have to think about the converting things to one way so if normally my application is an end-to-end with an acknowledgement rather than an acknowledgement at the transport layer then that's something people have to think about it say ok well how do I redesign or how do we rethink how I'm getting data out to my third parties and is there a way I can easily convert something so that's one of the biggest challenges is just getting people to think in terms of one way versus you know your sort of standard 2 way and I think once you start to think that ways ok well yes clearly I could push this data or this is tcp/ip you know or there's a protocol acknowledgement a protocol layer or a sorry application layer acknowledgement do I really need that is it important if as long as I know the data is getting across and there's a quite a we didn't get into this at all but on the diode itself there is an acknowledgement capability and what we do is we change the onus on the receiving side to be the one to verify that it's received what it should have received so normally think people think I'm sending hey I'm sending Scott sending data is a Chris Chris hey Chris did you get what I just sent you and then you would respond and say yeah I got what she said and they send me some more what happens in the diode you can't tell me that you got what I sent you so instead what we do is we send markers and check sums and hashes on the data we're singing across and you look at it and say ok yep I got this I'm expecting this next and did you get that next and now the onus is on the receiving side to say did I get everything that I was supposed to get rather than the sender saying did you get everything I sent you and so there's a whole algorithm around how that works obviously if you didn't get if you notice there's an anomaly than what you would do is raise an alarm or send a error or something - hey I'm not getting you know what I expected to get and this is typically doesn't happen the latency on the on the platform is in milliseconds you know three to four to five kinds of milliseconds and because we're going such a short distance over a dedicated cable that's not at the cable you know fiber-optic it's not routing there's no switching in there there's no anything that's traversing it's dedicated to point-to-point there's no reason if you're operating with the bandwidth in the band bandwidth limits of the device that packets or anything would ever get dropped there's just no reason for it to ever happen and so we have customers they literally come up in a conference yeah way to change something you know the day we haven't modified in two years and I had to go dig around and find the password because we set this thing up and it's just running quietly in the corner and we never ever touch it so you know that's that you know that's the kind of environment you're working in another question from Charles here Scott where did they at state of diodes fall in the business land firewall DMV firewall control network where do they fall let where does day-to-day business okay gotcha sorry so yes they would so it really depends on the configuration and who wants the manage if we see them typically physically located within let's say I'll call it the plant right whatever that is you know it's a pump station or whatever it is that you're protecting with one side facing the inside of the plant and manage typically by someone at the plant that has knowledge of it and then the other side could be managed by the nighti Department or whoever they're in network you're connecting to to get that dead data out to the final destination so sometimes at the edge of the plant sometimes it's the edge of a DMZ sometimes it is on the ingress side of an IT network so if you want to talk roughly a high level ot versus IT to be at the edge of the OT network the operations technology network at the edge of the we've seen them at the edge of a like a sock right security operation center or a knock or someone's doing replication and so they may want to protect the the final destination of a replicated database or a historian or something like that so there's lots of different it really comes down to how you're going to manage it and who owns one side and the other side because again they're they manage completely independently there's no way to manage both sides of the box so it it comes down to network configuration but most of the time we see them at the plans it sounds like a real any questions come from Daniel yes do you need one day to die out for every external connection so the answer is no you can have as many rights you can lots of sources of information on the inside so like we saw in some of those use cases where you could have PLC is reporting information on getting syslog information and I'm getting historian all that information can be down funneled through a single diode across and then on the other side it can go out to one or more destinations you know however you want to set up the information because it's configured and then there's also fault tolerant and failover scenarios to where you could have things operating in parallel and once I taking over for the other if there was a failure okay it's your fun question it's got it what's the most unusual face of a third party enable attack that you would set you've work done anything really strange as you've seen that you think back on it's a lot it was really unusual situation well because of the nature what we do we don't usually see attacks coming to do what we do see is customers and customers are very reluctant for us to talk about who they are and that they unfortunately I'd love to we have a we have a marque of really great customers that I'd love to talk about but they really prefer that we don't but what you can do sometimes we'll see articles in the paper will say XYZ facility was attacked and typically you see as that attack is against the IT Network crisis coming through email but the generation facility or whatever it is the actual you know where they're they're actually delivering product if you want if that product maybe electricity or the product maybe you know some kind of manufactured goods or whatever it is the plant that's producing that product was you know not attacked and they said well that was limited just the IT side or just our you know email server or whatever our plan was never in jeopardy and so we use a lot of those scenarios where there was an infiltration hit the OIT site but never was able to get through the OT side and that's really because you've got a busily a diode sitting there in between preventing anybody from getting in so those are the kinds of things we say okay if you have a fan here Scott Maria asks what is the next upcoming conference that you were attending at which you could see data diode demo in action we're doing stuff all the time we've got a cybersecurity summit coming up actually in Rhode Island I think that's in beginning of July but yeah I mean that stuff's all listed on our website anybody's interested in where we might be because we we're at a bunch of different verticals we and you know we attend water/wastewater shows we attend nuclear shows with in oil and gas shows and then on the DoD Intel side we're going to Air Force bases and Intel shows etc so because of the nature of how these are you and we end up going to a lot of different places on a regular basis and probably go to 60 cut different conferences both domestically internationally every year so we got a very busy marketing if I were trying to cover all those shows keep an eye out for Maria yeah um Francisco where can I find a vendor with this technology using data dials so so al is a vendor we do provide that technology so you could certainly look at our website and you know we have a product suite that scales from very low so five megabits up to multi gigabit ten gigabits and it really depends on how much data you have so we see customers that maybe just have a single turbine or something or a solar facility where there'd just need to keep an update you know sort of a trickle of data so to speak coming out and they would they would tend to put a lower-end solution in to get that OPC traffic or whatever it is off of that device back and then we've got full plants running you know doing database replication or historian replication and millions of tags you know with updates and throwing that across so you can take a look and you can see that that spectrum of solutions available really looking at what protocols you know someone who needs to do support simultaneously how many flows and then sort of with that Dan with requirement and then in sizing depending on here you know if you like the one you kind of a frame form factor where you've got in the 19-inch one in a you racks from that rack mount solution or we also have din rail solutions you know they would mount to you know like any other Rockwell or Schneider equipment in that kind of form factor so bunch of stuff out there very interested to talk to somebody if they're interested talking to us okay let's do a future a little bit here Scott what's uh how do you see a text change in the coming five years what's looming on the horizon sure I think I think what I mean when we're starting to see is people you know if you think back to that one of the earlier slides we talked about the Internet of Things and industrial Internet of Things where you've got cameras now and you've got other small devices that need to be projected so we're seeing the growth and expectations coming from our customers where they're saying you know what I've got this really small end point I don't need a lot of bandwidth but I need up I want to make sure it's secure so whether that's some sensor along a pipeline or some camera at a bank or whatever it is so we're looking at those we're seeing people very interested in those point solutions as the Internet of Things sort of explodes the other net spectrum is the cloud right and everyone's talking about big data and lots of cloud storage and repositories and backups and all that so the question is how do you populate the cloud right how do you get stuff into the cloud without someone coming into my plan so if generating tons of data maybe I don't even not going directly to a third party maybe I'm just putting something up in the clouds that some can access and need to though mobile devices I mean that they expose only other things we've seen recently where I got you know I've got 8,000 wireless users or and they need to run an application to go hit against the database well they can do is they'll hit an application that's outside of that secure database the diode would do the communication inside to the database so you have a single point of connection into that data source bringing that data back out and then distributing it through the application so I think as the cloud gets you know I mean it's already prevalent right I mean isn't it it's not like it's around the horizon it's read it's really there today and it's really talking about bigger larger amounts of data and how do I populate the cloud and how to populate those repositories that are being used and shared inside the cloud and keeping my source of my information secure I think about the Equifax breach right well if they had they had segmented their network properly right me as a car dealer chip I need to verify that hey Chris is this Chris how could credit you know should I loan him you know make him this loan for this car I should be able to access your information say yes or no but I shouldn't be able to look at all your details and know your credit history and all those other things that they use to make a decision right that should all been protected you know segmented that are hidden behind you know a diode potentially and and said no one needs to access this only our analysts on the inside will make a determination as to what Chris's cre
it rating is but on the outside we'll make available in the clouds let's say an application where I can put your social security number your name blah blah blah and I come back with a credit score so that I can finish if I could do my job without exposing that sort of information of thousands or millions of people just you know so those are the things people have to think about moving forward sure we're nearing the end of the of our time window here there's any left any questions please do submit them Gretchen asked a question about this isn't for you Scott this is kind of housekeeping will recording this web access a labelled with you later yes of course the webinars are always on demand you could log in exactly as you logged in for this live webcast to access it and you should be receiving the communication with the URL once that is available on-demand and again those listening on-demand can submit questions via the question box and those will be replied to in due time we'll give it about 30 more seconds again there's a handout section on the left side of your screen with collateral from today's event and a offer for the upcoming smart industry conference in September when we leave the session here you will be prompted to complete a quick survey we ask that you take that to enable us to make future webinars even better and unless I see anything come into the question box in the next few seconds I'm going to say to you Scott thank you for sharing your expertise today that was great thank you for the opportunity appreciate the time and everybody who was able to attend today yes and thank you to everyone who joined us have a wonderful day
