Enterprise Digitalization and Automation for Cyber, Ethernet, Wireless, Cellular, and Bluetooth Enabled IoT/OT Devices and Data

The status quo in converged Enterprise information technology (IT) and operational technology (OT) networks (in the commercial, federal, and defense industries) is physical connectivity with network level segmentation, network-based intrusion detection/prevention (IDS/IDP), and firewalls. Achieving logical trusted connectivity to implement a cost-effective and highly efficient zero-trust architecture over existing network infrastructures and in-field devices requires a paradigm shift from “cyber threats” to “cyber risks” and from “multi-layer peripheral defense” to “operational resilience at the core” for long-term desirable outcomes with application security by design. Policy based governance of millions of geographically distributed and connected devices for asset discovery, observability, and control by traditional network and security operations center (NOC/SOC) operators requires a unified platform and interoperability with multi-vendor heterogeneous devices over a plurality of communications protocols and existing network infrastructures.

The deployment, configuration, and operations of artificial intelligence (AI) systems in operations technology (OT) environments require policy based governance for security and safety. The diversity of communications protocols and data formats pose interoperability challenges for integrating AI systems with OT using a simplified approach to device, application, and data security by design. The quality of the initial training data, the transparency (reasoning) and explainability (decision logic) of AI models, and intrinsic variance (over time) in OT environments may cause drift in pre-trained AI models, adversely impact the accuracy of predictions, and generate inappropriate analysis and improper actions.

Cybersecurity and AI are intertwined and inter-dependent platforms. Cybersecurity uses rules based grammar and published threat intelligence with explicit programming for intrusion, infection, and anomaly detection, and classification of threats and remediation actions. AI uses algorithms, data patterns, agents, retrieval augmented generation, and reinforcement learning without explicit programming for classification, efficient decision-logic, and generation of autonomous actions.

Symmera’s Distributed Intelligent Network (DIN) platform for digital trust is an implementation of zero trust for enterprise digitalization. DIN simplifies information and operations technology (IT/OT) convergence and enables trusted data to AI models for machine learning. It helps establish horizontal trust in digitally connected systems, devices, and data. DIN leverages authoritative, trusted, and immutable identities of devices (air-gapped or cyber physical systems) and existing root-of-trust anchors in network environments (including DHCP, DNS, and secure elements) to establish verifiable and transitive trust in devices and data.

• AI systems expand the OT attack surface and cyber risks. The DIN platform supports digital trust and observability for enablement of AI in OT environments. DIN provides asset identification with IEEE 802.1AR compliant trusted identifiers, two-factor device authentication, secure field communications, cryptographic protections for applications and data, and managed and gated workflow-based remote software and configuration updates. DIN enables supply chain content risk introspection with software bill of materials (SBOM), common vulnerability and exposure (CVE), known exploited vulnerabilities (KEV), and vulnerability exploitability exchange (VEX) datasets-based analysis.
• Implementing zero trust solutions in converged IT/OT environments is complex due to challenges associated with network segmentation, proprietary protocols, message formats, latency requirements, heterogeneous OT products, resource constrained devices, and a plurality of device vendors. AI offers predictive modeling and processing of large OT datasets in near real-time for data driven insights for risk analysis and mitigation actions. The DIN platform supports push-based harvesting of device metadata (e.g., attributes, events, logs, telemetry, non-text) for enrichment of training data with labels and risk classification.