ARC VIEW. Industrial Defender and ABB Cyber Security Partnership Model. Summary. Cyber Security Strategies for Automation Suppliers.

Transcription

1 ARC VIEW DECEMBER 9, 2010 Industrial Defender and ABB Cyber Security Partnership Model By Robert Mick Summary Securing industrial control systems (ICS) remains a challenge, partly because there are multiple parties involved. End users would like their ICS suppliers to be responsible, but ICS security requires an evolving set of third-party security Owners of industrial control systems (ICS) have always wanted their ICS components, some third-party services, and includes end user practices and policies. This makes suppliers to take responsibility for cyber security. ICS suppliers have reacted it difficult for ICS suppliers to know exactly what differently to this customer need. ABB strategy to follow, and has led to differing ICS and Industrial Defender recently formed supplier approaches. ABB and Industrial Defender a strategic partnership and it is worthwhile to examine what they recently formed a strategic partnership and it is believe is the best approach. worthwhile to examine what they believe is the best approach. Cyber Security Strategies for Automation Suppliers Cyber security for industrial control systems (ICS) has been evolving and best practices for ICS suppliers are starting to emerge. For example, by now all ICS suppliers should have security-related product development methods baked into their processes, should offer comprehensive security guidance to their customers, should make sure their products are compatible with third-party security products, and should educate their support staffs about cyber security. However, in other areas, the best role for ICS suppliers is still unclear and supplier strategies differ. Suppliers differ most relative to the offering of security-specific products and services. Some ICS suppliers manufacture and sell security products, others offer third-party products on their price lists, and others offer none, but test with leading general-purpose security products. Similarly, some ICS vendors offer formal services for sale, while others simply help customers as part of their normal support. VISION, EXPERIENCE, ANSWERS FOR INDUSTRY

2 ARC View, Page 2 Recently ABB and Industrial Defender formed a strategic relationship focused on ICS cyber security. Both companies feel strongly that this is the best model for delivering cyber security to ICS customers and it is worthwhile to review their business model, reasons, and expectations. ABB-Industrial Defender Strategic Partnership Elements Under the terms of the agreement, ABB will sell, deliver, and support all existing Industrial Defender hardware and software security products immediately. This includes the products shown in the figure below, including the recently released Industrial Defender Host Intrusion Prevention System (HIPS), based on whitelisting technology. Industrial Defender General Architecture and Components Of course, some ABB customers will want to use ABB systems with other security components and there is no exclusivity in the partnership. Similarly, Industrial Defender already has OEM relationships with GE and ITRON, and there is no reason that these relationships should change. The two companies are still solidifying support plans, but it appears that other than software maintenance ABB will perform technical support for the Industrial Defender components it sells to its customers. Industrial De-

3 ARC View, Page 3 fender will be involved as needed, especially while initial training of ABB sales and support organization is underway. The companies are also in the process of setting up test and demo systems. ABB will not sell Industrial Defender services, but there is nothing precluding ABB or its customers from acquiring Industrial Defender services as needed. This arrangement will evolve as experience is gained and customer feedback collected. The partnership is not limited to any particular industries but initial efforts will focus on the energy industries specifically power generation, energy management, substation automation, and high voltage grid systems. Work is also under way with ABB process automation groups, with some early customers in the oil & gas industry. This aligns well with Industrial Defender s experience and increases the likelihood of early success. ABB has already started taking orders and reports high initial activity. Strategic: Beyond Existing Industrial Defender Solutions ICS cyber security is a very dynamic area with a constant stream of new threats, vulnerabilities, patches, associated strategies, and such. Consequently, ICS supplier strategies require flexibility and continuous improvement. ABB and Industrial Defender describe their partnership as strategic, suggesting that it involves more than just reselling existing Industrial Defender products. The partnership includes significant R&D engagement. The immediate approach is for ABB to use Industrial Defender solutions as separate components, but the company intends to integrate the Industrial Defender technologies tightly, possibly embedding them within ABB products. This means that Industrial Defender R&D will be working closely with ABB R&D. For this to be most effective, product management and planning for both companies will also have to engage heavily. ABB is a large and diverse business, offering Industrial Defender many opportunities for deep engagements and many product evolution paths. For example, Industrial Defender has already engaged the ABB-acquired Ventyx organization. Ventyx has considerable business in the energy industries and can benefit from a strong ICS cyber security offering. However, this sort of engagement will certainly generate ideas and an environment in which new directions for Industrial Defender will be evaluated, possibly beyond security, building on Industrial Defender capabilities.

4 ARC View, Page 4 Customers will Benefit from the Relationship Quite often, mutual customers drive partnerships and even acquisitions and, undoubtedly, this partnership involved was some of that. ABB and Industrial Defender had common customers before forming the relationship, and those customers stand to benefit considerably. They can now have a single sales and support point for their ABB and Industrial Defender solutions. Products will now be tested together thoroughly and evolve according to a coordinated plan. These same benefits will also attract more ABB customers to use the Industrial Defender-based solutions. The partnership Industrial Defender remains vendor- provides proven cyber security solutions with the agnostic, intends to maintain or promise of stronger integration and support over improve existing OEM relationships, the long run. Furthermore, Industrial Defender and hopes to develop strong services can be used to get a third-party ICS security perspective when relationships with other ICS suppliers. needed. Why this is a Good Strategy for ABB ABB is a large company with considerable resources, so why wouldn t it simply develop security components on its own? First, this is not a defined ABB business direction and that makes a lot of sense to us. Today s ICS cyber security strategies require several complex technologies and the only feasible way to quickly become a comprehensive ICS cyber security supplier would be to acquire several security-focused companies, integrate their products, and maintain a strong internal security R&D program on several fronts. While feasible, this would be quite an undertaking and customers would not benefit substantially for some time. Furthermore, ABB s opportunity would be largely limited to its own customers, tending to create yet another set of security products for customers to manage. Another interesting question is why did ABB decide to partner with Industrial Defender, instead of one of the large security component suppliers such as Intel (McAfee), Symantec, or Trend Micro? After all, this is a viable strategy being used successfully by other ICS suppliers. The answer is that ABB values Industrial Defenders understanding of the ICS industry and breadth of purpose-built ICS security offerings. Industrial Defender s business model is to define ICS security needs and then develop or acquire the

5 ARC View, Page 5 necessary components to create solutions that are directly suitable for ICS systems. With this partnership, ABB does not have to do this. ABB has considerable R&D activity, including some of that is security Furthermore, Industrial Defender is vendor agnostic related. This partnership brings a well-informed, third-party expert and many ABB customers have ICS products from perspective to ABB and opens the multiple vendors. This makes it easier for customers door to shared and exchanged to consolidate their ICS security infrastructure and intellectual property. get consistent cyber security support that is aware of ICS requirements. What this means for Industrial Defender Industrial Defender s strongest value to customers has always been based on having a complete focus on the needs of ICS owners and being ICS vendor-agnostic. The new ABB relationship guarantees that Industrial Defender will remain focused on ICS systems. Furthermore, it will grow its ICS user base dramatically, giving the company a richer customer perspective and more insight into industry needs. It will also take it into other industries faster that would otherwise have been possible. Over the years, most ICS owner-operators have made it increasingly clear that they wanted their ICS suppliers to take more responsibility for cyber security. Recognizing this, Industrial Defender welcomed ICS vendor relationships, while continuing to sell directly to end users. Industrial Defender has already worked with partners, GE and ITRON, which prepared them for shaping the deeper ABB relationship. The ABB engagement takes Industrial Defender to the next level in OEM partnerships and will give the company much better insight into how to help the ICS suppliers serve their customers better. However, the relationship comes with its challenges. ABB is a large company and could easily consume too much of Industrial Defender s attention. Considering the nature of the partnership especially with ABB providing support to their customers this is only a short-term risk. The first task for Industrial Defender is to get ABB teams up to speed, and this is already well under way both domestically and internationally. Some may be concerned that Industrial Defender might not remain ICS vendor agnostic. This is not likely to happen because Industrial Defender

6 ARC View, Page 6 reports more than 300 existing non-abb customers. Furthermore, Industrial Defender management is well aware of the dangers of basing their entire go-to-market strategy on one partner or OEM. Conclusions and Observations The new ABB-Industrial Defender strategic partnership is one of the more interesting models that ICS supplier can use to satisfy customers ICS cyber security needs. It amounts to the ICS supplier leaving the acquisition and creation of security components up to a third party totally focused on ICS needs. The ICS supplier must then integrate those components, and build sales, support, and services around the resulting products. Customers benefit more when the third party is vendor-agnostic. Another model is for the ICS supplier to acquire and integrate security components from multiple sources, providing all ICS expertise where needed. Where ICS needs require additional or different products than commercially available, the ICS vendor must To continue on its path of supporting all create or engage a partner to create them. This ICS vendors, Industrial Defender must model is being used and works as well. In simplistic terms, it places more responsibilities on the ICS continue to invest in creating additional innovative products and services that benefit all ICS vendors and must supplier. encourage stronger OEM relationships across the board. Other models seem to be less likely to be viable over the long term. For example, an ICS supplier may simply test with some number of security components and leave implementation and support to others. The biggest concern with this approach is that technical support personnel from general-purpose security component suppliers are unlikely to have sufficient ICS knowledge or experience over the long term. For further information or to provide feedback on this article, please contact your account manager or the author at bmick@arcweb.com. ARC Views are published and copyrighted by ARC Advisory Group. The information is proprietary to ARC and no part of it may be reproduced without prior permission from ARC. Some of the work on this paper was funded by Industrial Defender.