Step 2: Network-based security monitoring and IDS

Rhebo Industrial Protector

Sovereign & on-premise: Detect cyber attacks, anomalies and error states in your OT

Worker in front of electrical switch box

Cybersecurity for OT networks

The network-based intrusion detection system (NIDS) by Rhebo advances the existing perimeter firewall security by integrating continuous passive security monitoring with anomaly detection for OT network communication. It enables to detect and respond to successful attacks via security gaps, brute force, zero-day exploits, internal threats, backdoors or stolen credentials at an early stage.

Rhebo Industrial Protector provides dedicated OT security compliant with international standards and national regulations, without actively interfering with industrial processes. The on-prem solution Made in Germany strengthens sovereignty, control and reliability.

How it works

Rhebo OT monitoring with anomaly detection

Real-time Threat & Intrusion Detection

Rhebo Industrial Protector monitors all communication within, to and from the operational technology 24/7. The monitoring is integrated non-intrusively and passively at key points of the OT. Any communication that indicates cyberattacks, tampering, espionage or technical error conditions is reported in real time. This allows early detection of progressive attack patterns as outlined by the MITRE ATT&CK for ICS framework (see left). Companies can then respond quickly to risks and professional attack pattern to ensure the security and availability of their industrial processes. For distributed IIoT devices, active security automation can be optionally implemented to strengthen fleet protection.

Cross-location Monitoring for Internal OT Security

Rhebo Industrial Protector can be easily integrated across multiple sites and operated centrally. The sensors are installed as lightweight hardware or an integrated software solution on existing security gateways, network components and IIoT edge devices. For distributed IIoT edge devices, an active version with security automation is also available to ensure real-time fleet security.Companies gain visibility and clarity across their entire networked, industrial infrastructure at all times - and ensure end-to-end OT security.

Detailed Documentation & Threat Intelligence

Rhebo Industrial Protector continuously visualizes and documents all active devices and systems in operational technology networks. Important properties such as firmware status, protocols, behavior patterns and existing CVE vulnerabilities are documented on a daily basis. Any identified anomaly is recorded with all details as PCAP. The threat intelligence information can be forwarded to SIEM systems or other security components.

‍Companies gain a comprehensive picture of their risk exposure and can react to threats quickly and in a targeted manner.