FA-M3 Partners

Next-generation industrial IPS: EdgeIPS^TM (TrendMicro Incorporated)

EdgeIPS is a transparent IPS for industries that installs in-line before critical assets such as HMIs and PLCs to prevent vulnerabilities and unauthorized access without changing the NW architecture of existing installations, thereby helping to stabilize production lines.

To the product page 
(To the Trend Micro website)

 

*OT Defense Console (a separate product for centralized management) is required for managing EdgeIPS and remote distribution of IPS filters (signatures), etc.

Features

Protecting and visualizing critical assets

• Protect critical assets with FW, IPS, protocol filters, DoS prevention, and more
• Priority support for industrial protocols used in the Japanese market
• Provides high-precision industrial IPS filters utilizing ZDI knowledge
• Visualize asset information and used protocol information

Easy operation

• Transparent IPS enables deployment without changing the NW architecture of existing installations
• Compact size, easy to install in control boards
• Fast recovery with Zero-Configuration (planned)
• Per-unit management with CLI/Web Console
• Centralized management and monitoring with OT Defense Console (ODC)
• Operations and management in a closed environment (planned)
• Visualize network configuration (planned)

Highly reliabile hardware

• Fanless design
• Supports redundant input power
• Operating temperature range: -40 to +75 ℃
• 5-year hardware warranty
• Certified for various technical conformities (planned)
• Self-death monitoring and automatic recovery (planned)
• Hardware bypass

Main functions

* Since OT Defense Console is required when activating EdgeIPS, you must purchase it when you deploy EdgeIPS.

Deployment

Transparent for enhanced security without changing the network settings of existing equipment Prevent vulnerability attacks, infection and spread of worms (such as Wanna Cry), and unauthorized access on the internals and externals of production line A. Protect HMIs running legacy OS from vulnerability attacks and worm infections, and prevent horizontal infections in production line A. Prevent trouble caused by tampering and operational errors by allowing program write commands to PLCs only from EWS. Prevent vulnerability attacks and worm intrusion from terminals brought in by maintenance vendors.

Next-generation industrial IPS for large-scale networks: EdgeIPS^TM Pro (TrendMicro Incorporated)

EdgeIPS Pro is an industrial IPS for large-scale networks that supports stable operation of production lines by preventing vulnerabilities and unauthorized access. By installing in-line controlled by core switches, critical assets such as distributed networks or multiple HMI and PLC units can be secured without changing the NW architecture of existing installations.

To the product page 
(To the Trend Micro website)

Features

Protecting and visualizing critical assets

• Protect critical assets with FW, IPS, protocol filters, DoS prevention, and more
• Provides high-precision industrial IPS filters utilizing ZDI knowledge
• Visualize asset information and used protocol information

Easy operation

• Centralized management and monitoring with OT Defense Console (ODC)
• Manage individually on the web console
• Transparent IPS enables deployment without changing the NW architecture of existing installations
• Fast recovery with Zero-Configuration (planned)

High performance/high scalability/high availability

• Throughput 1048: 10 Gbps/2096: 20 Gbps
• Expandable IO modules (12 pairs) (1048: 2 Slots/2096: 4 Slots)
• Supports redundant input power
• Self-death monitoring and automatic recovery (planned)
• Hardware bypass (1048: 24 Pairs/2096: 48 pairs)
• Redundant architecture

Main functions

*Since OT Defense Console is required when activating EdgeIPS Pro, you must purchase it when you deploy EdgeIPS Pro.

Deployment

Transparent for enhanced security without changing the network settings of existing equipment Example: Between core switch and edge device Prevent lateral infections between devices in the production line Between core switch and edge device Prevent lateral infections between production lines * Lateral infection under the control of the edge switch cannot be prevented

Next-generation industrial firewall: EdgeFire^TM (TrendMicro Incorporated)

EdgeFire is an industrial security appliance that separates networks and counters vulnerability attacks on individual production lines by stabilizing new production lines and reducing security risks when connecting vulnerable groups of equipment to new networks.

To the product page 
(To the Trend Micro website)

 

* OT Defense Console for centralized management (sold separately) is required to manage EdgeFireTM and remotely distribute IPS filters (signatures).
*EdgeFireTM power supply and power cable must be provided separately. The power cable terminals require ferrule processing.

 

Features

Building safer NW segments

• FW, NAT, protocol filters, VLAN, VPN(planned), and more
• Provides high-precision industrial IPS filters utilizing ZDI knowledge
• Visualize information on assets and protocols used

Easy operation

• Front wiring
• Manage individually on the web console
• Centralized management and monitoring with OT Defense Console (ODC)
• Fast recovery with Zero-Configuration (planned)
• Operations and management in a closed environment (planned)
• Visualize network configuration (planned)

Highly reliabile hardware

• Fanless design
• Supports redundant input power
• Operating temperature range: -40 to +75 ℃
• 5-year hardware warranty
• HA Configuration (planned）

Main function

* Since OT Defense Console is required when activating EdgeFire, you must purchase it when you deploy EdgeFire.

Deployment

Limit access (network isolation via FW/NAT, etc.)

• Making the historian in production line A accessible only from certain servers in the DMZ reduces the risk from unauthorized communications between other equipment in production line A and external NW, as well as the risk from worm infections and other attacks targeting other services in the historian.

Prevent vulnerability attacks from within the accessible range
(Prevent vulnerability attacks and worm infections with IPS)

• If a specific server in the DMZ that allowed communication with Historian in production line A is attacked, even if the vulnerability attack targets Historian through that server, IPS blocks the attack.
• Even if EWS infects production line A with a worm such as DOWNAD via a USB memory or WannaCry via a portable terminal, it prevents the worm from spreading beyond the network of production line A.

Prevent illegal operation from within the accessibile range
(Prevent illegal operation with protocol filters)

• In an environment where the VLAN is disconnected from LAN1 (to which the historian, HMI, and EWS are connected) and LAN2 (to which control equipment such as a PLC is connected) in production line A, and only communication between the HMI and PLC is permitted, it is only possible to read parameters from the HMI to the PLC. Other operations are prohibited (such as parameter settings and program overwriting), thus preventing illegal operations.
• Parameter settings (ｗrite) and reading (read) from the MES are possible when the PLC in production line A is connected to the MES (Manufacturing Execution System) present in the upstream NW, but program rewrite (config) is prohibited to prevent unauthorized operations.

* Since there are restrictions on east-west IPS and protocol filters, use EdgeIPS when aiming to prevent horizontal infection.

Centralized security management console: OT Defence Console^TM (TrendMicro Incorporated)

OT Defense Console is an integrated management and monitoring tool for information such as: the number of connected industrial control devices protected by EdgeIPS, EdgeIPS Pro, and EdgeFire; the device and manufacturer names; IP addresses; OS versions; and usage protocols for the devices.

To the product page 
(To the Trend Micro website)

 

Features

Centralized management makes operations more efficient

• Install at each plant for centralized management of EdgeIPS, EdgeFire, and other devices
• Manage and apply multiple policies via group settings
• Distribute IPS filters (signature files) to each device

Visualize security events and more

• Aggregate detected and blocked security events
• Visualize asset information collected by managed devices
• View total traffic by IT/OT protocol and application traffic for each asset in real time

External server connection via syslog transmission

• Automatically send syslog to installed syslog servers

Main functions