In a previous blog post on IoT network anomaly and threat detection (ATD), we briefly discussed the need for IoT network ATD solutions, the key security challenges relevant in the IoT context, and how such solutions protect connected device ecosystems. This blog discusses the capabilities of vendors in the IoT network ATD world and provides a snapshot of vendors, each looking to combat the inevitable security issues pertaining to IoT devices.
But before we delve into the details, here's a quick refresher on the need for such solutions. As the connected devices ecosystem grows across industries, so does the complexity of managing the evolving cyberthreats that exploit vulnerabilities present in such devices. Connected devices are present in every sphere of life, and therefore, addressing cybersecurity issues becomes increasingly important to ensure that businesses operate smoothly and no harm is done to public safety and national security.
In our IoT network anomaly and threat detection vendor profiles report, we have discussed 18 leading vendors operating in this market, profiling the capabilities and features that each offers with reference to a range of IoT network anomaly and threat detection functionalities. For more information on these vendors, please read Transforma Insights’ recently published report: ‘IoT network anomaly and threat detection vendor profiles’.
There are various players operating in the IoT network ATD market, each including multiple features and offering various capabilities to protect connected devices. In the graphic below we have highlighted the seven key capabilities that IoT network ATD solution providers should ideally offer.
Seven of the leading IoT network ATD vendors are highlighted in the following sections, along with a brief overview of their IoT network ATD offerings. For detailed insights into a longer list of 18 vendors and their IoT network ATD offerings, please read our report on the topic.
Aeris IoT WatchTower is a cellular IoT focussed agentless platform for monitoring network traffic and delivering visibility into cellular data sessions, SIM usage, and supporting enterprises to better monitor SIM abuse, abnormal SIM movements across geographies, and SIM cloning. It allows enterprises to apply network-level policies to limit connected devices to approved ports and IP addresses and block malicious communication.
Fidelis Security is a provider of cybersecurity solutions which can analyse threats in encrypted traffic using the company’s patented Deep Session Inspection. This approach reconstructs TLS/SSL sessions to pull more than 300 meta-attributes, such as packet-size distributions, session durations, and endpoint IP/port pairs.
floLIVE’s IoT security solution is agentless and offers network layer visibility at the cellular core network level with multi-IMSI telemetry that provides information related to SIM abuse, abnormal roaming, and carrier switching. The company offers a SOC (Security Operations Center) style dashboard developed for cellular-based connected asset threat monitoring with a built-in AI assistant that converses in natural language to manage users’ queries.
Forescout offers the Forescout 4D platform, which is based on Universal Zero Trust Network Access (UZTNA), to grant least-privilege access to assets across IT/IoT/OT workflows. It offers network segmentation to restrict the access of compromised devices to reduce the spread of a potential threat across the network. The platform’s strength lies in agentless device monitoring and performing deep packet inspection (DPI) of more than 350 IT and OT protocols.
Nozomi Networks offers three types of solutions for network and device monitoring: Guardian, to analyse network traffic (mainly for wired connections); Guardian Air, primarily for wireless connections; and Remote Collector, for edge environments, which gathers and forwards data from isolated network segments to the central management system. It performs deep packet inspection of industrial, IT, and IoT protocols, which enables analysis of payloads, operational states, and device interactions. The solution is used to monitor more than 115 million OT/IoT/IT devices globally.
Palo Alto Networks offers a cloud-based Enterprise IoT Security solution leveraging the company’s machine-learning-driven Next-Generation Firewall (NGFW) platform and allowing integrations with a range of third-party systems and tools that support network management, asset discovery, asset management, identity and access management, and endpoint protection.
Wireless Logic offers an agentless IoT network anomaly and threat detection solution to support enterprises and solution providers in accessing AI-enabled device insights into their cellular IoT systems. It uses an AI-enabled and rule-based threat detection engine to increase the accuracy of threat identification. The company’s network ATD solution uses passive monitoring techniques to monitor the mirrored data collected (packet headers) from the company’s cellular core network to deliver AI-based threat insights.
In fast growing connected device ecosystems, multiple vendors are offering IoT network anomaly and threat detection (ATD) solutions to monitor device behaviour. Vendors are increasingly adopting AI-based solutions to detect network abnormalities, which in turn helps them to identify anomalous device activities. Today this is a fast-evolving industry, and we expect quick evolution or even revolutionary IoT network ATD solutions to help combat cyberattacks in the future.
