Bayshore Networks: Enabling Policy-Based, Content-Aware Security for the Industrial Internet of Things

Transcription

1 VENDOR PROFILE Bayshore Networks: Enabling Policy-Based, Content-Aware Security for the Industrial Internet of Things Christina Richmond Pete Lindstrom IDC OPINION The Internet of Things (IoT) is propelling innovations and advancements in many areas; however, connecting "things" without first understanding and addressing security increases risk substantially. Sophisticated cyberthreat adversaries are making inroads into enterprises with stealth, patience, and cunning. Unsecured IoT implementations may be inadvertently flashing a sign: Enter Here. IDC predicts that by 2020, there will be a projected 30 billion connected "things" (see Worldwide Internet of Things Forecast, , IDC #256397, May 2015). Legacy Internet Protocols and traditional security defenses are not likely to work or be sufficiently comprehensive to cover new types of endpoints, many of which exist outside of information technology's (IT's) traditional digital security sphere. Bayshore Networks has taken a new path by developing a policy-based, content-aware cybersecurity solution one that speaks the language of industrial IoT devices and enables enterprises to customize security at the individual machine level. In detail: Unconnected endpoints such as industrial devices (e.g., robots and manufacturing machines) in operational technology (OT) environments are now being viewed opportunistically by IoT visionaries and early adopters. These visionaries and adopters are savoring the possibilities inherent in linking objects to networks for purposes of enabling faster delivery of products and services, capturing cost efficiencies, improving processes with data analysis, and reinventing customer experience. In the near future, it's likely that the convergence of IoT, IT, and OT will prompt choices and work-arounds that are largely bolt-on solutions or extensions of traditional threat countermeasures. This particular convergence, however, calls for outside-the-box thinking on the part of security providers and security buyers. IN THIS VENDOR PROFILE This IDC Vendor Profile analyzes Bayshore Networks, a provider of cloud-based cybersecurity solutions for industrial environments. This Vendor Profile reviews key success factors, including company strategy, product strategy, offerings, partnerships, and target market. SITUATION OVERVIEW Company Overview Bayshore Networks operates at the intersection of cybersecurity, the Internet of Things, and information technology/operational technology. Since its inception approximately three years ago, the company's core focus has been network controls, specifically firewalls. With the rise of IoT, however, the Bayshore team recognized the need for a different kind of security for industrial environments. September 2015, IDC #258818

2 Currently, fewer than 100 employees work in Bayshore's offices in New York City and Research Triangle Park, North Carolina. The company's management team members have expertise in software, applications, Web services security, data security, cybersecurity, network communications, and other technology areas, in addition to experience with start-up and early-stage companies. Company Strategy The shorthand version of Bayshore's strategy is: provide enterprises with an extra layer of security ("Layer 8" to use Bayshore's term) that is policy based rather than configuration based and that filters on content rather than metadata. Bayshore's Layer 8, which is agnostic to protocols and applications, delivers policy building and enforcement capabilities as well as categorization and filtering by users, devices, applications, documents, and transactions. The Bayshore team developed its cybersecurity solution after pairing two insights: traditional IT security solutions are not effective with machine-to-machine (M2M) protocols and machine behaviors, and each enterprise has unique requirements for protecting its applications, data, documents, machines, and transactions and this calls for customized policies. Product Strategy Bayshore's product strategy recognizes that IT and OT are two different worlds that need to be brought together in a common cause: security. Bayshore's assessment of the situation is the following: In the OT/machine world, safety and availability are top priorities; and policy-based controls are the language of machines and industrial process. In the IT world of networks, firewalling and identity control are top priorities; and configuration-based controls are the language of perimeter protection, protocols, and IP addresses. When machines are connected through computer networks, manufacturing plant managers require two things: that nothing coming through the network can make the machines behave in an unsafe or inefficient way and that any telemetry leaving the machines won't get into the wrong hands, like those of competitors. The controls required to meet these two requirements need to be able to look at content and the data of transactions in a way that is aware of what the machines are doing and how the processes work. Firewalls don't do this, and the requirements can't be met through metadata inspection. Any connection with a machine, for reasons such as troubleshooting, diagnostics, or analysis, cannot send signals, messages, or transactions that change what the machine does (thus supporting the line-of-sight best practice in manufacturing facilities). As a result, the security solution must involve reads only, and this requires policy-based, content-aware controls that can discern the difference and filter out writes IDC #

3 Bayshore's technology functions in a way that meets the two aforementioned requirements on a device-specific basis. Low-latency proprietary architecture is designed to prevent hacking, in part because there is no IP address. Further, the solution is designed to detect malware such as malicious encrypted commands, which can appear as legal, normal, authorized, and authenticated communications. Bayshore's cybersecurity solution works at gateway points on enterprise networks, so it can be installed inline, on network taps, or in private or hybrid clouds. In addition, policy-based, content-aware controls can work efficiently across large numbers of machines, so this capability addresses IoT scale concerns. The technology is expected to deliver results for enterprises in areas such as plant safety, data protection, data loss prevention, cybersecurity for industrial/production environments, secure remote access, and business/operational continuity. Use cases are available for predictive maintenance, plant safety, data loss prevention, regulatory compliance, security embedded in industrial products, and remote-access security. Product/Service Offerings The Bayshore IT/OT Gateway platform is added on top of an enterprise network or cloud fabric to help secure IoT and OT data. It is available as a cloud-based service, a virtual machine, or an on-premises appliance. Key functions include content inspection, filtering, and categorization of Layer 3 and Layer 4 protocols and Layer 7 data that moves through a network, as well as other content such as archived documents. Further, this platform categorizes devices, data, and device security details to provide users with visibility into OT networks along with the ability to segment and isolate networks and applications. Supported protocols include DNP3, Modbus/TCP, EtherNet/IP, IEC 61850, PROFINET, BACnet, MQTT, CoAP, AMQP, XMPP, and HTTP over REST. Each Bayshore IT/OT Gateway includes Bayshore's Pallaton engine, which is a XML-based policy language. Pallaton is designed to enable policy execution and enforcement throughout an enterprise after it is customized to the context of the enterprise's IT and OT networks. Using configurable rulesbased decision making, Pallaton inspects content such as Web flows, industrial protocols, and file shares. Go to Market Bayshore plans to expand its direct sales, engineering, and field engineering teams during the next 18 months. The company is currently going to market with Cisco, which is targeting industrial Internet of Things verticals, including manufacturing and energy utilities; and BAE Systems, which is targeting oil and gas and critical infrastructure. Bayshore will announce more go-to-market partnerships in the coming months. Partnerships Bayshore also partners with software integration companies such as SAP, VMware, Splunk, and SecurView. Target Markets Bayshore defines its market as Fortune 1000 industrial organizations in verticals such as manufacturing, utilities, and oil and gas. It organizes its customers into three groups: industrial controls, critical infrastructure, and industrial enterprise IDC #

4 FUTURE OUTLOOK Challenges and Opportunities Discussions of IoT produce a range of reactions from those who are terrified by the security challenges and those who are exhilarated by the business opportunities. Since IT and OT come to IoT from different directions and with differing priorities, the education and sales cycle is likely to be long and winding. However, it's clear that IoT is well out of the gate and speeding down the track, and security service providers are scrambling for footholds. Enterprises are likely to feel pressured to participate in IoT sooner rather than later even if security isn't fully baked, especially if their competitors are moving forward. The burden will be on enterprise decision makers to parse solutions and determine the best fit for their organizations. They will likely have many choices in the form of start-ups, existing firewall suppliers, consultancies, managed security services (MSS) providers, and so on. Diverse solution approaches, compliance requirements, technology integration, and nascent security standards for IoT make a complex situation even more complex. Significantly, Bayshore is working with IT analytics software vendors such as Accenture, SAP, and Splunk to deliver OT telemetry data to analytics applications that are typically used in IT. Bayshore adds value to analytics applications by providing a depth of machine transaction data that was previously unavailable. When industrial devices are connected and secured, however, enterprises can eliminate human intervention, lower costs, and improve service delivery by performing remote diagnostics and upgrades. Further, by gathering and analyzing vast amounts of data from connected devices, enterprises can gain insights useful for product development and customer experience. Without proper industrial IoT security, risk increases exponentially. Just one successful cyberattack can result in the loss of intellectual property, cause lengthy and expensive business disruption, and negatively affect brand perception. ESSENTIAL GUIDANCE Advice for Bayshore Networks IDC believes Bayshore is well positioned to grow in the emerging IoT market, which is predicted to have a double-digit CAGR (see Worldwide Internet of Things Forecast, , IDC #256397, May 2015). The company's solutions and expertise should appeal to large enterprises, most or all of which are likely to be involved in planning or executing IoT initiatives. To support its growth in the IoT market, Bayshore should: Tell its IT/OT/IoT story in as many forums and mediums as possible to leverage its advantage in a new market. Develop proof points in the form of references and/or case studies that demonstrate before/after scenarios and ROI. Develop educational materials targeted to CXOs, IT/OT leaders, and chief information security officers (CISOs) that help these executives understand IoT-related security challenges and what they need to know to make informed decisions IDC #

5 Capitalize on buyers' preference for cloud-based delivery and the opex business model. Continue to develop partnerships that augment the company's sales/distribution efforts and build momentum in the market for example, data analytics and compliance could be excellent complementary areas to explore as standard or optional solution components. LEARN MORE Related Research IDC's Worldwide Internet of Things Security Taxonomy, 2015 (IDC #256841, July 2015) IOT: Security Service Providers Cautiously Rejoice (IDC #lcus , July 2015) Worldwide Internet of Things Spending by Vertical Market Forecast (IDC #256255, June 2015) Worldwide Internet of Things Forecast, (IDC #256397, May 2015) IDC's Worldwide Internet of Things Taxonomy, 2015 (IDC #256186, May 2015) Worldwide and Regional Internet of Things Forecast Update by Technology Split (IDC #252330, November 2014) 2015 IDC #

6 About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA USA idc-insights-community.com Copyright Notice This IDC research document was published as part of an IDC continuous intelligence service, providing written research, analyst interactions, telebriefings, and conferences. Visit to learn more about IDC subscription and consulting services. To view a list of IDC offices worldwide, visit Please contact the IDC Hotline at , ext (or ) or sales@idc.com for information on applying the price of this document toward the purchase of an IDC service or for information on additional copies or Web rights. Copyright 2015 IDC. Reproduction is forbidden unless authorized. All rights reserved.