Comparison of industrial COB: ISIM vs. Kics

The sensational attacks on Norwegian aluminum producer Norsk Hydro and the Venezuelan energy system once again showed that industrial enterprises are still vulnerable to hackers. We decided to figure out which specialized OWLs - intrusion detection systems - help to combat such cybercrimes and are able to “see” intruders in the network segments of ICS. Choosing from five solutions, we settled on two - KICS for Networks from Kaspersky Lab and ISIM from Positive Technologies - and compared them according to 40 criteria. What we did, you can find out under the cut.

Why owls to industrial enterprises

1. External threats

   
   According to Alexei Petukhov , head of Kaspersky Industrial CyberSecurity in the Russian Federation, “Russia has entered the TOP-20 countries in terms of the percentage of ICS TP computers attacked.” Unfortunately, in Russia it is not customary to spread about incidents occurring at the production site, but our experience suggests that the situation that Norsk Hydro faced could be repeated in domestic industrial enterprises.
   
   A detailed analysis of the attack on Norsk Hydro read here .
   
   There is a common misconception that by dividing industrial and corporate networks and excluding access to the Internet, the company guarantees itself security. But this is not so. Now attacks are planned and implemented for a rather long time - attackers carefully prepare for an attack and think through a hacking scenario in detail. Moreover, the motivation of attackers can be completely different. Ransomware and ransomware try to hit as many devices as possible, intelligence agencies aim to inflict maximum damage to the infrastructure, etc. But any attack has its own cycle, which always begins with intelligence. Owls are able to detect cybercriminals already at this stage and to notify about the threat, stopping the activities of attackers at the initial stage of the attack.
   
   The attacks will continue further, and it was necessary to prepare for them yesterday.

2. Internal threats

   
   The most common threats are not external, but internal. Unhappy with the position or salary, employees can use corporate capacities for their own purposes. Dismissed workers leave bookmarks by selling access to Darknet or by exploiting infrastructure for their personal interests. In practice, we were faced with cases when workstations were installed software for remote computer control for operational management or work from home. In such stories, a dilemma often arises, which usually leads to a confrontation between “security guards” and “school assistants”: which is more important - ease of maintenance or safety? Often at enterprises you can see workstations without any protection that are forbidden to touch, since any impact can lead to a shutdown of the process. But for the intruder (external or internal) this will be the main goal of the attack. The company should not suffer because you trust your employees and leave room for manipulation.

3. Legislation

   
   The state is building the GosSOPKA system, which, as planned, should not only inform the FSB of all identified incidents at work, but also become a full-fledged database of computer attacks occurring in Russia. Now we are at the beginning of the road, and it is difficult to say when the state bodies will reach the goal. Nevertheless, in 2017, 187-ФЗ “On the Security of Critical Information Infrastructure of the Russian Federation” was issued, followed by a number of orders from the FSTEC, which also determine the procedure for categorizing CII objects and measures to ensure their safety. After assigning a category of significance to each object, the company must ensure its protection. So, the FSTEC Order No. 239 of December 25, 2017 tells us about the measures that the subject (state bodies, state institutions, Russian legal entities, as well as individual entrepreneurs, to whom by right of ownership, leases or on any other legal basis belong to IP, ITS, ACS) is obliged to apply when protecting objects KII. For owners of objects of category 2 or 1, the regulator in the indicated order establishes the requirement to use an intrusion detection tool. We are convinced that due to the practice of underestimating categories, such solutions will be useful to all objects of KII.
   
   Requirements of the Order of the FSTEC No. 239 dated December 25, 2017
   Section VII. - Intrusion Prevention (COB) requires the COB.1 “Detection and Prevention of Computer Attacks” requirement for critical information infrastructure facilities of category 2 and 1.

OWL functionality

In our opinion, solutions should provide the following features.

1. Monitoring the technological network with the ability to support the technological protocols of the main manufacturers of process control systems.
2. Automatic detection of device type (AWP, server, PLC).
3. Ability to control the process.
4. Intrusion detection in a technological network.
5. Transfer of recorded events to third-party monitoring systems (SIEM) with the possibility of their analysis.
6. Graphic construction of a technological network map.
7. Creating and uploading reports.
8. Assistance in investigating incidents.

How did we choose solutions for comparison

When choosing solutions for research, we were guided by three main criteria: the presence of the product on the Russian market, our own project experience and the compatibility of the solution with other vendor products.

Today, at least 5 solutions are presented on the Russian market that can be considered as SOW in industrial networks:

• KICS for Networks from Kaspersky Lab;
  
• ISIM from Positive Technologies;
  
• ASAP from InfoWatch;
  
• Datapk from USSB;
  
• SCADAShiled by Cyberbit.
  

From the whole variety, we chose 3 solutions that, in our opinion, are now the most popular in the Russian market: KICS for Networks from Kaspersky Lab, ISIM from Positive Technologies and ASAP from InfoWatch.

During the negotiations, InfoWatch decided not to participate in the comparison. Colleagues are preparing to release a new version of their product and at the time of the comparative analysis were not ready to provide it to us for testing. We will be happy to add this solution to the next version of our comparison.

As for the solutions from Kaspersky Lab and Positive Technologies, both companies provided us with distributions for independent study and quickly answered our questions during the testing process. In favor of KICS for Networks and ISIM solutions, we also played a role in the fact that earlier we already implemented them both for testing and in industrial operation. In addition, both products can be integrated into other integrated solutions. For example, ISIM works great in conjunction with Max Patrol SIEM, and often both products are tested. Kaspersky Lab has KICS for Nodes, a specialized solution (antivirus) for protecting servers, controllers and workstations located on an industrial network. In this review, we did not set ourselves the goal of comparing the completeness of integration with other products and limited ourselves to the functionality of the selected solutions. Nevertheless, this is an important factor when choosing a system for implementation.

How was the comparison

For a qualitative comparison, we determined the criteria and divided them into 5 groups. The basis was the questions most frequently asked by our customers when choosing a solution. We did not analyze the technologies used in the products in detail, but studied only the fundamentally important ones that affect the choice of a particular solution.

Then we deployed stands on the Jet Infosystems virtual servers and watched the latest products: KICS for Networks 2.8 and ISIM 1.5.390.

According to the results of the study, we compiled a comparative table and sent it to the vendors for approval. They supplemented with their comments those assessments that they considered necessary. Comments of vendors are given in separate columns of comparative tables and in italics. Our findings are presented in the “Comments” section and may differ from the position of the vendors.

Comparative review of SOW (industrial IDS)

Note. The table in italics indicates the comments of the vendors.

Table 1. Comparison of the group of criteria "Functional"

In this group, we compare the main functional components of industrial traffic monitoring systems. For comparison, we chose technologies that are fundamental for traffic analysis in industrial control systems. We believe that these criteria should be present in all SOVs, both specializing in the processing of technological traffic, and for identifying threats that arise at industrial enterprises.

Table 2. Comparison of the group of criteria "General"

In this group we consider the ease of use and architectural features of the SOW. We have identified the main criteria that are presented during the implementation of the system and are considered by users when choosing a solution.

Table 3. Comparison of the group of criteria "Service"

This group includes criteria for additional services from vendors. We chose the most popular services in which customers are interested.

Table 4. Comparison of the group of criteria "Cost"

The cost of ownership of OWL is not provided by vendors.

Table 5. Comparison by the group of criteria “Normative”

This group contains the basic requirements that customers place on all information security solutions. The availability of FSTEC and FSB certificates is important for companies associated with the public sector. Analytical reports show the level of maturity of the solution in the international market.

Pros and cons of the solutions reviewed

Here we give our subjective assessment of strengths and weaknesses. Strengths can easily be converted to weaknesses and vice versa.

KICS for Networks

Pros:

• Ability to add individual network monitoring events through the management console.
  
• Ability to import tags from a CSV file, as well as generate a list of tags based on traffic recognition (for some protocols).
  
• All functionality is available in one license.
  
• All functionality is present in one solution.
  
• There are protocols for compatibility with the main vendors of industrial control systems.
  

Minuses:

• Configuration is performed only through the management console installed on the server. Through the web interface only monitoring is performed.
  
• An event report is generated only through Kaspersky Security Center.
  
• The inability to individually configure the network map.
  
• Closed price list.
  

ISIM

Pros:

• Easy installation, configuration and further operation.
  
• Simple and intuitive web interface.
  
• Monitoring and management are concentrated in one place.
  
• Graphical representation of network nodes with the ability to group.
  
• Ability to store and export network traffic.
  
• Creating reports and uploading them in PDF format.
  

Minuses:

• Creating individual rules for controlling the network only through the vendor.
  
• Full functionality is available only in the Pro version.
  
• Closed price list.
  

findings

The OWL market is actively developing due to the emergence of new threats and the urgent need to detect them in a timely manner. Competition encourages manufacturers to look for their niche, to come up with “chips” that will distinguish their solutions from others. Vendors develop products, respond to user needs, and with each release it becomes easier to work with solutions.

How to make a choice. The disadvantages and advantages of the solutions reviewed by us are individual for each enterprise. For example, if you use a protocol that is supported by only one intrusion detection system, the choice becomes obvious. Although it cannot be ruled out that the vendor will be ready to meet you and add the necessary functionality to the product.

An important factor is the price. ISIM has a more interesting approach with the choice of functionality (due to two product versions), and KICS for networks is built on the principle of "all in one". Be sure to ask manufacturers partners for the cost of the initial purchase of solutions. It will not be superfluous to look at the cost of ownership (purchase + support) by a solution for 3-5 years.

If the company already uses other solutions of one of the vendors considered in the review, it is worth considering this. We met different variations at industrial enterprises. Some industrial companies use KICS for Nodes to protect workstations, and ISIM as an intrusion detection tool. Combined solutions also have a right to exist.

The best way to understand which solution is right for you is to pilot or seek advice from companies that already have experience in implementation.

Electronic and print versions of the review will be released shortly.
This review was prepared by: Vitaliy Siyanov, Anton Elizarov, Andrey Kostin, Sergey Kovalev, Denis Terekhov.