The Vortex OT SOC monitors ICS and cyber-physical systems 24x7x365, with IEC 62443 assessments and dozens of compliance projects for the routine of the ONS, Brazil’s grid operator.
In short: The Vortex OT SOC, a cell of the Cyber Defense Center, the Vortex Converged NG-SOC (NG-SOC Convergente), protects industrial environments, ICS and cyber-physical systems 24x7x365. Vortex applies IEC 62443 in its assessments and has completed dozens of projects to comply with routine RO-CB.BR.01 of the ONS (Brazil’s National Electric System Operator).
In just over a decade, attacks on industrial environments have gone from espionage and side effects of IT incidents to causing disruption and direct destruction of operations. In most cases, the point of entry was simple: phishing, remote access, VPN or a supplier.
The first sophisticated digital weapon: sabotage of the uranium enrichment centrifuges in Iran.
A malware toolkit for gathering information used in later attacks on industrial environments.
Sophisticated malware that spreads over the local network or via USB and records audio, the screen and user activity.
Destructive malware that wiped data and crippled thousands of computers at Saudi Aramco.
The Dragonfly/Havex campaign against utilities and energy companies.
The attack caused physical damage to the plant’s blast furnace.
NotPetya affected 1,700 servers and 24,000 laptops at the food manufacturer.
The REvil ransomware forced the shutdown of beef plants in the US, Canada and Australia.
Ransomware halted production and shipping at the world’s 5th largest brewer for about a week, with an impact of USD 120 to 140 million.
The Conti ransomware disrupted production at snack factories in the UK.
Ransomware forced the shutdown of all its food plants and caused shortages in supermarkets, at a cost of USD 10.5 million.
The Cactus ransomware hit about 30% of its 243 cold storage warehouses and suspended the cold chain.
Ransomware destroyed the ERP: operations ran in manual mode for months, creditors cut off credit and the company went bankrupt.
An alarm at 1:30 a.m. and the immediate shutdown of four breweries in Belgium and one in the US, for more than three days.
With expanding connectivity and the addition of new smart devices (IIoT, the Industrial Internet of Things) to these environments, the risk multiplies, especially in environments that require complex, lengthy updates. Combined with the growing expertise of cybercriminals, this scenario affects the short- and long-term planning of professionals in the sector.
Source: Claroty, Industrial Buyers Guide
When the attack enters through the corporate network and reaches the plant, a traditional, IT-focused SOC sees disconnected alerts and leaves OT out of view. The Vortex NG-SOC Convergente correlates IT, OT and AI in the same detection context and shows the entire attack path.
Traditional SOC
NG-SOC Convergente
Traditional SOC: Alert queue, no correlation between IT, OT and AI: Failed login · server; Connection blocked · firewall; Malware detected · endpoint; Port scan · DMZ; Off-hours login; Suspicious attachment · email; Unusual process · endpoint; Anomalous traffic · server. OT outside the SOC’s view. AI with no visibility.
NG-SOC Convergente: 1 prioritized incident.
Illustrative environment, alerts and incident.
The use of equipment from different manufacturers, the diversity of industrial protocols and the advance of digital transformation in industry make cybersecurity a growing challenge. In this scenario, the OT SOC stands out by providing greater visibility of the industrial network and an effective approach to mitigating cyber risks.
The OT SOC allows industries to move forward with confidence in their modernization, preparing for the integration of technologies such as IoT, 5G and automation, boosting efficiency and operational security.
Get a granular view of new and legacy devices located in industrial environments.
Gain observability across all levels of your OT environment.
Maintain the integrity of your endpoints.
Segment your networks and promote secure traffic between zones with different protection levels.
Manage each device’s protocols centrally and respond quickly to risks.
Automation and artificial intelligence to increase the speed and response capacity of your SOC.
New threats call for more targeted strategies. By adopting a specialized approach, Vortex transforms the monitoring and management of industrial environments with intelligent automation capable of taking action quickly, delivering a next-generation SOC service.
Each risk is silent under normal conditions. Together they form the invisible attack surface, and mapping them is the starting point.
The Vortex Risk Assessment applies the Cyber-PHA of ISA/IEC 62443-3-2: instead of asking which CVEs exist on the network, it asks what happens to the process if an automation function is compromised.
In five steps and two workshops, risk is measured from 1 to 25 by severity and likelihood, controls are linked to ISA/IEC 62443-3-3 and the executive report translates everything into the investment decision.
OT security has its own references. The IEC 62443 series is the international basis for protecting industrial automation and control systems. In the electricity sector, REN ANEEL nº 964/2021, a normative resolution of ANEEL (Brazil’s National Electric Energy Agency), and operational routine RO-CB.BR.01 of the ONS add regulatory requirements to this basis.
A series of ISA and IEC standards for industrial automation and control systems. It groups assets into zones, controls communication between them through conduits and defines four security levels, from SL 1 to SL 4, according to the attacker’s capability.
In force since July 1, 2022, it requires electricity sector agents to have a cybersecurity policy approved by the board of directors or an equivalent body and to report the incidents with the greatest impact.
Sets the minimum controls for the Regulated Cyber Environment (Ambiente Regulado Cibernético, ARCiber): supervision zones, operational and corporate DMZ, remote access via VPN, asset inventory, patch management, access control and monitoring.
Vortex applies IEC 62443 in OT environment assessments, defining zones, conduits and security levels. It has also completed dozens of RO-CB.BR.01 compliance projects, and its OT services meet the ARCiber controls.
Our professionals and methodologies are guided by the market’s leading best practices, standards and guidelines, so that organizations can be confident they are receiving the best cybersecurity risk management.
Understand and manage the assets, risks and vulnerabilities related to cybersecurity.
Implement appropriate cybersecurity measures to protect assets and systems against identified threats.
Develop and implement mechanisms to proactively identify the occurrence of cybersecurity events.
Establish action plans to respond effectively to cybersecurity incidents.
Develop and implement strategies for fast, efficient recovery after a cybersecurity incident.
By establishing a high level of detection and response, Vortex expands the use of resources and opens the way to innovation and automation in industrial environments.
By following Gartner’s CPS security journey, Vortex is able to provide the best recommendations for each client’s needs and objectives, creating an appropriate progression of maturity levels and thus developing effective processes for the security of their industrial environments.
Our track record is marked by pioneering projects and the ability to take on the most complex challenges in industrial cybersecurity. With a proactive approach and advanced technologies, we help our clients anticipate threats and keep their operations secure and uninterrupted.
Its capacity to manage hundreds of thousands of assets, in a highly accurate CDC that is proactive in anticipating threats, enables the complete orchestration of solutions and resources, with process automation, threat intelligence techniques and increasing use of AI.
To maximize the effectiveness and reach of the OT SOC, Vortex Security establishes strategic partnerships with global leaders in technology and cybersecurity, ensuring that our clients have access to the latest and most effective tools to protect their OT environments.
It is a cell of the Cyber Defense Center, the Vortex NG-SOC Convergente, specialized in industrial environments, ICS and cyber-physical systems (CPS), with 24x7x365 monitoring. Its analysts are trained in industrial security and know OT protocols and processes, and the playbooks respect the plant’s operational constraints. The focus is uninterrupted operation.
Because when the attack enters through the corporate network and reaches the plant, an IT-only SOC sees disconnected alerts and leaves OT out of view. In the NG-SOC Convergente, industrial telemetry is correlated with IT events, and the attack appears end to end, from phishing in the office to an attempt to manipulate a controller at the plant. According to Claroty’s Industrial Buyers Guide, 32% of respondents had both IT and OT systems impacted in the same attack, up from 21% the previous year.
Monitoring is designed to protect the process without stopping production. Discovery and inventory of OT assets are passive, with no operational impact, which matters because there are legacy assets that cannot take agents. Response playbooks respect the plant’s operational constraints, and vulnerability management respects industrial maintenance windows.
Yes. Vortex applies IEC 62443 in OT environment assessments, defining zones, conduits and security levels, and links each recommended control to the requirements of ISA/IEC 62443-3-3 for the target security level (SL-T). In the water and sanitation case, the ISA/IEC 62443-3-2 Cyber-PHA brought unacceptable risk to zero without replacing the installed automation base.
A list of CVEs tells you what exists on the network; risk tells you what happens to the process if an automation function is compromised. The Vortex Risk Assessment uses the Cyber-PHA of ISA/IEC 62443-3-2 and measures risk from 1 to 25 by severity and likelihood, with the consequences for people, the environment, finances and reputation. The vulnerability scan still exists, but it serves as evidence for likelihood, not as the final result.
There are five steps and two workshops: scope and stakeholders, reference threat actor, functions and consequences by Purdue level, severity and likelihood and, finally, risk, controls and residual risk. The company receives the complete Cyber-PHA, the IT and OT asset inventory, the vulnerability survey, the NIST SP 800-82 compliance assessment with ranked gaps, the ISA/IEC 62443-3-3 controls by security level, the current topology and the target architecture, and an executive report for the board, with investment guidance.
Yes. Vortex has completed dozens of projects to comply with routine RO-CB.BR.01 of the ONS, Brazil’s National Electric System Operator, and its OT services meet the controls of the Regulated Cyber Environment (ARCiber), such as asset inventory, operational DMZ, remote access via VPN, patch management, access control and monitoring.
In most public cases, through a simple point of entry: a phishing email, remote access or VPN, leaked credentials or a supplier, like the compromised software update that brought NotPetya to Mondelez. When the attack enters through the corporate network and moves on to the plant, correlation between IT and OT helps detect this lateral movement early.
Schedule a conversation with our experts and find out how to strengthen your protection strategy and raise the maturity level of your operation:
Updated on
