OT Cybersecurity Vendors

Garland Technology makes the hardware that gets a copy of network traffic to the tools that need to see it: network TAPs, network packet brokers and hardware data diodes. A network TAP sits on the link itself and sends a full copy of the traffic to an OT sensor while the link carries on as normal. That is the practical difference in the network TAP vs SPAN port decision for OT network monitoring.

Where a SPAN port is the only source, a Garland data diode enforces one-way traffic with physical hardware separation, so the monitoring connection cannot send anything back onto the control network. On OT Cyber Direct you will find copper network TAPs, a hardware data diode and two aggregators, each with a published price.

Moxa has made industrial networking equipment since 1987, and integrators have been mounting its switches and serial servers on DIN rails for decades. What we carry is the security end of that range: an industrial secure router and an industrial firewall built for the same cabinets.

The secure router puts firewall, NAT, VPN and routing in one appliance at the IT/OT boundary, which also makes it an industrial VPN router. The LAN firewall is the smaller of the two and suits the spot directly in front of a machine or cell. Both use deep packet inspection, so an OT firewall rule can be about what a connection is doing and not only which addresses are talking.

TXOne Networks builds OT security tools and nothing else. The company was formed as a joint venture between Trend Micro and Moxa, and its products assume the plant cannot stop, cannot always be patched and often cannot take new software.

We carry its two inspection products. Portable Inspector Pro is a USB device that runs a malware scan from the stick, without installing software on the target or rebooting it. That answers a common question from IT teams: what to do when you cannot install EDR on an HMI. Safe Port is a scanning station for removable media, so contractor and vendor USB drives are checked before they go near a control system.

BlastWave makes BlastShield, which handles OT network segmentation and secure remote access for OT in one product. Gateways installed on site build encrypted, authenticated peer-to-peer tunnels to each device or group of devices, so staff and contractors reach only the systems they are responsible for.

That route skips the network redesign and firewall rulesets that usually make ICS network segmentation the slow part of a project. Our OT cyber experts tested BlastShield hands-on and found a network can be segmented in hours, not weeks. The BlastShield Segmentation Gateway is priced by the number of endpoints you need to protect, and BlastWave includes installation support at no extra cost.

NetAlly makes handheld network test tools, the kind a technician carries to the problem. We carry CyberScope, its handheld analyzer built for security assessment as well as troubleshooting.

NetAlly CyberScope discovers the devices on wired, Wi-Fi and Bluetooth networks, maps the topology and runs Nmap vulnerability scans from wherever you plug it in. That makes it a practical way to build an OT asset inventory or run an OT network assessment without installing fixed sensors. Active scanning needs care on a control network, so scope each scan with whoever owns the process.