You're reading from IoT and OT Security Handbook Assess risks, manage vulnerabilities, and monitor threats with Microsoft Defender for IoT

Product type Paperback

Published in Mar 2023

Publisher Packt

ISBN-13 9781804619803

Length 172 pages

Edition 1st Edition

Concepts

Cybersecurity

Authors (2):

Smita Jain

Vasantha Lakshmi

View More author details

Table of Contents (16) Chapters

Preface

1. Part 1: Understand the Challenges in IoT/OT Security and Common Attacks

2. Chapter 1: Addressing Cybersecurity in the Age of Industry 4.0 FREE CHAPTER

3. Chapter 2: Delving into Network Segmentation-Based Reference Architecture – the Purdue Model

4. Chapter 3: Common Attacks on IoT/OT Environments

5. Part 2: How Microsoft Defender for IoT Can Address the Open Challenges in the Connected World We Live in Today

6. Chapter 4: What Is Microsoft Defender for IoT?

7. Chapter 5: How Does Microsoft Defender for IoT Fit into Your OT/IoT Environment/Architecture?

8. Chapter 6: How Do the Microsoft Defender for IoT Features Help in Addressing Open Challenges?

9. Part 3: Best Practices to Achieve Continuous Monitoring, Vulnerability Management, Threat Monitoring and Hunting, and to Align the Business Model Toward Zero Trust

10. Chapter 7: Asset Inventory

11. Chapter 8: Continuous Monitoring

12. Chapter 9: Vulnerability Management and Threat Monitoring

13. Chapter 10: Zero Trust Architecture and the NIST Cybersecurity Framework

14. Index

Why subscribe?

15. Other Books You May Enjoy

The protocol violation detection engine

Generally, protocol violations can be identified by field values and packet structures that are being used in ways that go against the ICS protocol specifications.

In Figure 8.1, we can see Modbus Exception as an example of something picked up by the protocol violation engine. A secondary device did not send a response to the primary device when sending the exception code. This violation of the protocol was detected by MDIoT:

Figure 8.1 – Example of a protocol violation

Note

In the MDIoT portal for the Modbus alert, the primary device is referred to as the master device, and the secondary as the slave. However, due to their unsavory connotations dating back to colonization, standardization organizations have spoken against the usage of these terms. We have used primary and secondary in this book, but there are various alternatives available, such as controller-responder and primary-replica. You can read more...

The rest of the chapter is locked

You're reading from IoT and OT Security Handbook Assess risks, manage vulnerabilities, and monitor threats with Microsoft Defender for IoT

Table of Contents (16) Chapters

The protocol violation detection engine

Unlock this book and the full library FREE for 7 days

Authors (2)

Personalised recommendations for you