What Is Microsoft Defender for IoT?

How secure is the world of OT (operational technology), also known as industrial security?

Here’s a shocking stat. 98% of IoT device traffic is unencrypted.

Yet according to SANS, only 12.6% of organizations have full visibility across the cyber kill chain for industrial control systems.

Clearly, unsecured OT and IoT (internet of things) infrastructure is the biggest risk that many companies face.

Microsoft Defender for IoT solves many of these problems—but it must be configured and managed properly.

Here’s everything you need to know about this incredible tool.

Key takeaways:

• OT and IoT devices require special cybersecurity measures due to their inherent vulnerabilities.
• With limited computing power, OT and IoT devices require a passive monitoring approach, which is fundamentally different from IT security approaches.
• Microsoft Defender for IoT is a great choice for monitoring and protecting these devices.
• Defender for IoT can integrate into Microsoft Sentinel/Defender XDR, providing SOC analysts with comprehensive, real-time, and converged visibility across OT, IoT, and IT environments.

What is Microsoft Defender for IoT?

Microsoft Defender for IoT is a comprehensive security solution designed to protect devices in IoT and OT environments. Also known as D4IoT, the software focuses on safeguarding these devices from the unique cyberthreats that they face.

Here are the functions that D4IoT covers:

• Real-time asset discovery: Through passive network monitoring, D4IoT automatically identifies IoT and OT devices connected to your network.
• Vulnerability management: D4IoT detects vulnerabilities on connected devices as well as misconfigurations and risky behaviors. The tool also prioritizes vulnerabilities according to severity and risk level.
• Continuous monitoring: D4IoT monitors for anomalies, suspicious traffic, and unauthorized connections in real time, using behavioral analytics and threat intelligence designed specifically for IoT and OT environments.
• Integrated security management: D4IoT can integrate with Microsoft Defender XDR, Microsoft Sentinel, and other SOC tools. This gives cybersecurity teams a cohesive view of IT and OT security in real time and in-line access to industry-leading SOAR (Security Orchestration, Automation, and Response) features for real-time OT attack mitigation capability
• IoT device firmware analysis: D4IoT provides a firmware supply chain protection feature that supports Zero Trust initiatives. Uploaded firmware images from device vendors can be scanned for embedded security threats, vulnerabilities, and common weaknesses that may otherwise be undetectable—before the code is downloaded to any production OT devices.

Why do OT and IoT devices need special protection?

OT and IoT devices need special protection because they operate differently from traditional IT systems. Many of these devices were designed decades ago, before the advent of modern cybersecurity best practices and frameworks. Additionally, many modern OT devices require a ‘phone home’ capability to vendor clouds, creating an unavoidable IT/OT convergence. Consequently, OT assets pose a unique cybersecurity risk, and they require a dedicated cybersecurity strategy as well as ongoing cybersecurity management.

Here are the main reasons that these devices require their own security practice.

1. OT/IoT devices run on aging systems that are hard to update. Old firmware and legacy operating systems present unique challenges when it comes to patch management. Executing these updates often requires physical access, specialized knowledge, and production downtime. These roadblocks cause organizations to postpone updates, which leads to the accumulation of many security vulnerabilities over the long term.
2. OT/IoT devices don’t have enough computing power to run security agents. OT and IoT devices have limited CPU, memory, and storage capacities. Unlike workstations or servers, they can’t support antivirus software or endpoint detection. They may crash if an external agent scans them. To get around these limitations, these devices require agentless, passive monitoring, a completely different approach than standard IT security.
3. OT/IoT devices come with weak default security and credentials. Hardcoded passwords, default credentials that are searchable online, minimal encryption, and proprietary protocols without authentication make these devices sitting ducks. They require an intentional security strategy to overcome these weaknesses.
4. OT/IoT devices control critical infrastructure. An attack against an OT/IoT device usually has physical consequences. From medical equipment to manufacturing equipment to power distribution systems, these devices manage crucial processes in the real world. Outages can lead to medical emergencies, production halts, safety hazards, and environmental crises. These high-stakes devices are prime targets for hackers who want to hold systems for ransom or disrupt critical processes for their own gain.
5. OT/IoT devices weren’t designed for internet exposure. Original OT networks were isolated and air-gapped, without internet connectivity. Modern digital transformation initiatives have led to massive, complex, interconnected environments, thus exposing OT networks to the internet. Also, consider that even an air-gapped OT network is vulnerable to physical intrusion and merits attack detection sensors.

These are the primary reasons that OT/IoT devices require dedicated protection. They simply weren’t built for the world in which they now operate.

What types of devices does D4IoT protect?

Defender for IoT protects OT (operational technology) and industrial systems. Here are the most common types of devices  that D4IoT protects.

Industrial OT devices

• SCADA systems (Supervisory Control and Data Acquisition)
• BMS (Building Management Systems)
• DCS devices (Distributed Control Systems)
• PLCs (Programmable Logic Controllers)
• RTUs (Remote Terminal Units)
• HMIs (Human-Machine Interfaces)
• Industrial sensors and meters
• ICS (industrial control systems)

A different Microsoft product (Defender for Endpoint), when licensed as part of a Microsoft 365 E5 or E5 Security license, or Microsoft Defender for Endpoint P2, with an extra, standalone Microsoft Defender for IoT – EIoT Device License, protects Enterprise IoT (office automation) products and devices. Like OT/industrial security devices, Enterprise IoT devices can’t host their own security agent and must be monitored in a passive fashion.

This article covers the D4IoT industrial security product, but information is provided on the EIoT product for completeness. Here are the most common types of devices that Defender XDR-based Enterprise IoT protects.

Enterprise IoT devices

• VoIP phones
• Printers
• Scanners
• IP cameras
• CCTV systems
• Smart TVs
• Other connected appliances

How does Defender for IoT bridge the visibility gap in IoT/OT cybersecurity?

Microsoft Defender for IoT bridges the visibility gap between IT, OT, and IoT networks by providing comprehensive, contextual, real-time monitoring and reporting of devices and network behavior. The software achieves this feat without disrupting the operation of critical systems.

Here’s how D4IoT achieves all this in detail.

1. Agentless, passive asset discovery ensures that D4IoT doesn’t impact device operation. D4IoT sensors safely identify every connected device in the environment without the risk of creating downtime.
2. Deep understanding of protocols and network topology allows D4IoT to analyze proprietary protocols and understand communication flows across the entire OT/IoT network.
3. Context-rich device profiles allow D4IoT to understand the purpose of each device, how it operates, and how critical it is.
4. Behavioral analytics for threat detection allow D4IoT to detect unauthorized device activity, abnormal network traffic, and lateral movement across OT/IoT devices.
5. Integration with SOC tools like Microsoft Defender XDR, Microsoft Sentinel, and 3^rd-party tools provide comprehensive threat visibility across OT/IoT and IT environments.
6. Risk-based prioritization and threat modeling empower D4IoT to score risks across devices and networks, identify misconfigurations and vulnerabilities, and model the most probable attack paths to critical assets.

Can Defender for IoT integrate with Microsoft Sentinel?

Yes! D4IoT is powerful on its own, but organizations unlock even more value when they integrate D4IoT with Microsoft Sentinel, the company’s flagship SIEM (security information and event management) solution.

Here’s what you get when you integrate the two systems.

• Centralized OT/IoT security monitoring: Alerts generated by D4IoT flow right into Microsoft Sentinel, giving your SOC team full visibility into your IT, OT, and IoT environments.
• Automated investigation and response: You can configure Sentinel playbooks as SOAR mitigations to respond automatically to OT/IoT alerts. For example, these playbooks can notify operators, isolate network segments, or add contextual background to threat intelligence.
• Cross-domain correlation: Sentinel connects the dots between IT endpoints, identity platforms, and cloud workloads, allowing the signal to emerge from the noise.
• Enriched incident investigation and handling: Incident tags, automation rules, watchlists, and the Machine Learning (ML) provided by User and Entity Behavior Analysis (UEBA) accelerate triage with higher fidelity and accuracy.
• Advanced analytics and threat hunting: D4IoT integrated into Sentinel allows you to run KQL (Kustos Query Language) queries on D4IoT data. This empowers your SOC analysts to detect lateral movement as well as anomalies in protocols and device behavior.

What does it take to support Defender for IoT?

D4IoT is a cross-functional tool within the broader domain of IT and cybersecurity. If you’re going to manage the tool in-house, you’ll need these resources on staff with bandwidth available:

• Network engineering team
• OT network management resource
• SOC team
• IT/OT admin and sensor management resource

The workload can become significant, which is why many organizations choose to outsource their OT/IoT cybersecurity. Doing so allows the customer to reduce costs and vendor count—especially if the MSP offers comprehensive managed services, as Corsica Technologies does.

If you choose to outsource, your MSSP (managed security service provider) should bring these roles into the management of your D4IoT instance and all relevant devices:

• IT/OT/IoT network consultant
• Sensor installation and network integration resources
• SOCaaS (SOC as a service) team
• Ongoing vCISO (virtual CISO) consulting

Some organizations choose a hybrid approach, in which internal resources collaborate with an MSSP to cover all the bases. Whichever way you go, a provider like Corsica can help you get the full security coverage you need for these vulnerable devices and environments.

The takeaway: Don’t wait to protect OT/IoT devices

The modern threat environment is evolving too fast for organizations to sit on their hands. Without appropriate protection, OT/IoT devices are prime targets for exploitation. This is why Corsica Technologies brings deep expertise in OT/IoT security to the table. If you’re interested in Microsoft Defender for IoT, contact us today, and let’s take your next step.’

Ready to secure your OT devices?

Reach out to schedule a consultation with our OT security specialists.

Schedule Now