Microsoft Acquires IoT/OT Security Leader CyberX

The news in brief: CyberX’s IoT/OT-aware behavioral analytics platform integrates with Azure security to deliver end-to-end security across managed and unmanaged IoT devices

Everyone has discussed Industrial Control Systems (ICS) cyber risks almost to the point of nausea for several years. Startups in the OT cybersecurity space began popping like dandelions in spring. For a couple of years their display spaces at the ARC Industry Forum paid for the room and then some.

While I like all these companies, I couldn’t see how any could make it long as a standalone company. Sure enough, CyberX has agreed to be acquired by Microsoft.

Here is the justification: As enterprises implement digital transformation and Industry 4.0 for greater efficiency and productivity, boards and management teams are increasingly concerned about the financial and liability risk resulting from the deployment of massive numbers of connected IoT and OT devices. Adversaries targeting this expanded attack surface can cause substantial corporate impact including safety and environmental incidents, costly production downtime, and theft of sensitive intellectual property.

By integrating the CyberX platform with the Azure IoT stack, Azure Security Center for IoT, and Azure Sentinel, the first SIEM with native IoT support, Microsoft will now provide a simpler approach to unified security governance across both IT and industrial networks, as well as end-to-end security across managed and unmanaged IoT devices, enabling organizations to quickly detect and respond to advanced threats in converged networks.

“CyberX’s technology and team are a great addition to Microsoft,” said Michal Braverman-Blumenstyk, Corporate Vice President, Cloud & AI Security CTO, and Israel R&D Center GM. “With CyberX’s expertise and innovative platform, together with Microsoft’s exciting security products, Microsoft is offering a powerful and scalable solution that accelerates digitalization for enterprises at all phases of their IoT/OT journey.”

Founded in 2013, CyberX achieved tremendous growth with the world’s largest enterprises adopting its IoT/OT security platform to secure their facilities worldwide. Leveraging patented, IoT/OT-aware behavioral analytics, CyberX’s agentless technology deploys in minutes to deliver deep visibility into IoT/OT risk — including asset discovery, vulnerability management, and continuous threat monitoring — with zero impact due to its passive Network Traffic Analysis (NTA) approach.

“Nir and I founded CyberX with the goal of delivering a scalable solution that would be easy to deploy and reduce risk for enterprises worldwide,” said Omer Schneider, co-founder and CEO of CyberX. “We’re thankful to our loyal customers and partners as well as to our dedicated employees whose innovation and hard work made it possible for us to reach this important milestone, and also to our investors for their ongoing support.”

“By joining forces with Microsoft, we will rapidly scale our business and technology to securely enable digital transformation for many more organizations,” said Nir Giller, co-founder, GM International, and CTO of CyberX. “Together, CyberX and Microsoft provide an unbeatable solution for gaining visibility and a holistic understanding of risk for all IoT and OT devices in your enterprise.”

CyberX’s founders will join Microsoft and the platform will continue to be enhanced and supported by CyberX personnel. In addition, Microsoft is committed to the channel and will continue working with CyberX’s strategic reseller and technology partners worldwide. The CyberX platform will continue to be available in a hybrid model supporting both cloud-connected and air-gapped networks.

From the Microsoft point of view—Two years ago, Microsoft announced a $5 billion investment in IoT and with this acquisition, the company is eager to continue solving these challenges. Some specifics:

• With CyberX, customers can discover their existing IoT assets, and both manage and improve the security posture of those devices. For example, customers can, often for the first time, see a digital map of thousands of devices across a factory floor or within a building and gather information about their security state and connectivity.

• CyberX’s further integration with Microsoft’s broad portfolio will allow Microsoft to continue to deliver more value to customers. For example, in conjunction with Azure Sentinel, SecOps personnel will be able to identify threats that span OT and IT converged networks that were previously challenging to detect.

• Microsoft appreciates that some customers need help improving the security of their existing IoT environment and is excited that CyberX’s technology and team will be an incredible addition to the company’s commitment to both IoT security and innovation as customers work to digitally transform their businesses.

Microsoft Acquires GitHub and Other Big Company and Open Source Thoughts

Microsoft Acquires GitHub and Other Big Company and Open Source Thoughts

Microsoft acquiring GitHub, the repository of many open source projects, on the surface appears almost as an oxymoron. However, as I’ve written previously about big companies and OPC UA standard big companies now find open source and interoperability to be sound business decisions rather than threatening to their proprietary hold on technology.

OPC and Standards

Two years ago in my Podcast Gary on Manufacturing 149 also found on YouTube, I asked the question why major suppliers of automation technology for manufacturing/production hated OPC UA—an industry information model standard. That is by far the most viewed YouTube podcast I’ve ever done. I followed up with Gary on Manufacturing 175 and YouTube to update the situation to current situation.

It is still getting comments, some two years later. Some guy (probably works for a big company?) even dissed me about it.

However, the industry witnessed an almost tectonic shift in the approach of these automation suppliers toward standards. First Siemens went all in on OPC UA. Then last November and following Rockwell Automation has had several deep discussions with me about the adoption of OPC UA.

Why? Users demand more interoperability. And using standards is the easiest way forward for interoperability. Suppliers have discovered that standards allow them to continue to push development of their “black boxes” of technology while allowing themselves and their customers to assemble systems of technology.

Microsoft News

In my favorite news site, Axios, Ina Fried writes:

Microsoft announced this morning it is acquiring GitHub, the social network for coders as well as home to millions of different software projects, for $7.5 billion.

“The era of the intelligent cloud and intelligent edge is upon us. Computing is becoming embedded in the world, with every part of our daily life and work and every aspect of our society and economy being transformed by digital technology. Developers are the builders of this new era, writing the world’s code. And GitHub is their home.”
— Satya Nadellla, CEO, Microsoft

Why it matters: This would further highlight the complete turnaround the company has already made in its stance toward source software.

Behind the scenes: While former Microsoft CEO Steve Ballmer once called Linux a cancer, the company has steadily warmed to open source, with Nadella embracing it with open arms.

GitHub plays into that strategy as it’s used by developers of all stripes to store their code projects. The San Francisco-based company was founded in 2008 and is now home to 80 million software repositories. The company has been searching for a new CEO since last year.

Why it matters: Playing host to the world’s code doesn’t necessarily make Microsoft a more central player, but it could tightly integrate GitHub into its developer tools. Microsoft decided last year to shut down its own CodePlex software repository, bowing to GitHub’s popularity.

What about Windows? Though certainly a fan of its homegrown operating system, Microsoft’s main goal these days is to be in tight with developers and get them writing code that can live in its Azure cloud.

Microsoft even dropped the Windows name from Azure, reflecting the fact you don’t have to use Windows to work with Azure.

History lesson: Microsoft’s shift to embrace Linux is somewhat reminiscent of the earlier move IBM made to do so. Both companies are now seen as the mature veterans of the enterprise market, more interested in meeting corporate computing needs than pushing homegrown architectures.

This information was also posted on the Microsoft Blog.

Other Open Source Information

My other travels and interviews have yielded other companies who have invested heavily in open source.

Within the last two years I have had a few conversations with Microsoft about their open source code donations. While I am a little surprised at acquiring GitHub, perhaps this will lend financial stability to the platform (although we do have to note that large company investments do not always insure financial stability.

Dell Technologies and Hewlett Packard Enterprise, two companies I have more recently studied are both proud to be contributors to open source. A couple of years ago considerable time at one of the keynotes at Dell World to open source projects.

I think that some of these companies are realizing that they don’t have to invent everything themselves. Being good software citizens benefits them as well as the community.

Microsoft Acquires GitHub and Other Big Company and Open Source Thoughts

Hit Refresh The Remaking Microsoft

Turning a giant organization that has the great inertia can be likened to turning a large ship at sea. It takes great force and a lot of space. Such is the task of remaking Microsoft.

Satya Nadella has been CEO of Microsoft replacing the combative Steve Ballmer more than three years ago. I’ve seen him speak at conferences at least three times. I’ve talked to many Microsoft people. He truly has turned that big mass toward the future.

Hit Refresh: The Quest to Rediscover Microsoft’s Soul and Imagine a Better Future for Everyone tells Nadella’s personal story, as well as his business and leadership.

He begins personally. The key takeaway is his discovery of empathy. I imagine that that value was in short supply in Redmond during Ballmer’s tenure. Nadella talks about a mentor, but also the birth of a handicapped child and what the family learned while caring for him introducing him to the emotion and value of empathy.

Like most people with an MBA, he was steeped in strategy theories. As he thought about his task as the new leader of Microsoft, naturally he thought about strategy.

His early three-pronged message was
1. Reinvent productivity and business processes
2. Build an intelligent cloud platform
3. Move people needing Windows to wanting Windows

Remembering Peter Drucker’s dictum, “Culture eats strategy,” he also move quickly to change the corporate culture. He includes a few stories revealing how he went about that gigantic task.

His view of what leaders tasks are:
1. Bring clarity
2. Generate energy
3. Find a way to deliver success

He has given much thought to values. These are similar thoughts to what we hear at National Instruments’ gatherings—engineers solving the world’s biggest problems. He urges policy makers, mayors, and others not to try to replicate Silicon Valley but instead to develop plans to make the best technologies available to local entrepreneurs so that they can organically grow more jobs at home—not just in high tech industries but in every economic sector.

 

Microsoft Makes Huge Investment In OPC Open Source Code

Microsoft Makes Huge Investment In OPC Open Source Code

OPC UA was everywhere in the Digital Factory and automation areas of Hannover Fair 2017.  Not only was the expanded OPC Foundation stand busy, an “OPC Wall” at the Microsoft stand was constantly packed. Microsoft executives took attendees on a digital path using OPC UA from the factory to the Azure cloud.

Spokespeople pointed out that OPC UA was crucial to a solution that was open, secure, and agnostic. While waiting for the finalization of OPC UA pub/sub (publish / subscribe), they wrote a transport in JSON and AMQP to get there.

The OPC Foundation announced an open-source implementation of the OPC UA technology, available on GitHub to truly enable the OPC community successful adoption of OPC UA across all markets and all platforms.

Microsoft contributed a huge amount of lines of code to this open source effort.

OPC UA is the set of standards for multivendor multiplatform secure reliable interoperability for moving /information from the embedded world to the cloud.   The testimonial to the standards is a complete reference implementation that is now been posted as an open-source implementation, replacing the original OPC Foundation .NET deliverables that were developed and maintained for the last 10 years.

The original OPC Foundation .NET OPC UA reference implementation has been available to OPC Foundation members and last year was provided as an open-source implementation on GitHub. This version was targeted and limited to Microsoft Windows only.

The new OPC Foundation reference stack, based on the new .NET Standard Library technology, was developed and optimized by Microsoft to serve as the complete platform-independent infrastructure, from the embedded world to the cloud. This new version is enabled on the following supported platforms: Various Linux distributions, iOS, Android, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Phone, HoloLens and the Azure cloud.

One of the important features of the .Net Standard stack is the expansion of the security features to meet the needs of the Industrial Internet of Things (IIoT) applications, as well as the requirements of “Plattform Industrie 4.0”.

Additional benefits of the OPC UA .Net Standard Stack include:

  • The .Net Standard stack is cross platform specifically enabling OPC UA applications.
  • The .Net Standard API portability strategy is all about developing once and running everywhere: No need to special-case OS-specific functionality.
  • The architecture of the .Net Standard stack focuses on managed code, which translates to rapid application development.
  • Microsoft deliberately enabled the creation of NuGet packages, which allows suppliers to quickly integrate OPC UA support into their application with a few simple clicks.
  • The .Net Standard stack includes increased security inclusive of support for SHA512.
  • The .Net Standard stack enable support for cross-platform UI design tools through Xamarin.
  • Microsoft has provided, in conjunction with the OPC Foundation, an extremely rich set of sample applications, inclusive of reference clients, reference servers, an aggregation server, an OPC classic wrapper and a web application to quickly display OPC UA telemetry data sent to the cloud.
  • Microsoft has also provided, in conjunction with the OPC Foundation complete samples demonstrating Azure connectivity leveraging the OPC UA publish/subscribe technology (the specification of which is currently being finalized).

Microsoft’s Sam George, Director of Microsoft Azure IoT said “OPC UA has truly established itself as the interoperability standard for Industrial IoT. We are honored to work with the OPC Foundation on the continued evolution of the standard. The response from the Industrial IoT community to our .Net Standard reference stack contribution has been very positive.”

OPC Foundation’s President Thomas J. Burke said, “The Microsoft commitment to open standards, and specifically to the OPC Foundation is absolutely amazing. Microsoft is clearly a pioneer and a leader in developing and bringing to market the best technology that truly enables multivendor information integration and interoperability. It has been a pleasure to work with the Microsoft development team, and how they are enabling so many of the suppliers to have seamless connectivity to the Azure cloud, through their development and commitment providing an open-source implementation of the OPC UA technology”.

Stefan Hoppe, OPC Foundation’s Vice President said, “Microsoft is the strongest open-source contributor to the OPC Foundation’s industrial interoperability standard, OPC UA. Microsoft’s integration of the OPC UA code with Microsoft Azure IoT as well as Windows IoT allows companies to bring millions of devices and apps to the public cloud and manage them with one single application, no matter if the devices run on Windows, Linux, iOS or Android. Using this OPC UA implementation, IT and Manufacturing will merge seamlessly”.

Siemens’ Thomas Hahn said: “As a founding member, Siemens has supported the OPC Foundation for years. For us, open connectivity – from shop floor to the cloud – is a must. We therefore appreciate the availability of OPC UA technology as open source!”

The OPC Foundation will continue to develop, maintain and extend this new .NET technology as the new OPC Foundation endorsed open-source .NET reference implementation. Some of these significant new features to be added include the publish/subscribe extensions as well as support for important IoT protocols like AMQP and MQTT.

Interoperability And Standardization Drive OPC Foundation Activity in 2016

Interoperability And Standardization Drive OPC Foundation Activity in 2016

Interoperability, standardization, and collaboration were the key words for OPC Foundation in 2016. Tom Burke, OPC Foundation President, recently recapped a busy 2016 for the Foundation. Adoption of OPC UA has been gaining momentum in the market. Collaboration with other groups is growing. And the technology is finally beginning to show significant use beyond industrial automation.

Burke says, “It has been a very exciting year. We have seen record growth in adoption of the OPC UA technology across multiple domains and vertical markets. The OPC Foundation policy of being truly open has expanded the reach of the OPC technology. The specifications are available to everyone, the technology is open sourced, and now we have opened up our certification labs to non-members.”

The OPC Foundation byline since the beginning has been recognized as the “The Interoperability Standard for Industrial Automation.” With the significant international membership growth and adoption of the OPC UA technology across multiple vertical markets the byline of the OPC Foundation has been ratified as “The Industrial Interoperability Standard.” This byline recognizes the case that OPC is no longer just for automation.

OPC UA specifications and technology are actively being deployed across global boundaries supplying the key infrastructure for everything related to the Internet of Everything (IIoT, Industrie 4.0, China 2025, IIC, M2M…); inclusive of:

  • numerous testbeds with the OPC UA technology being standardized in the Industrial Internet Consortium (IIC)
  • being recognized as the communication and information modeling standard for Industrie 4.0
  • OPC UA being finalized as a Chinese National Standard

In May 2016, BSI (German Federal Office for Information Security) conducted a thorough security analysis of OPC UA and found it exceeded the security requirements for Industrie 4.0.

Collaboration with numerous organizations beyond industrial automation is the strategy and path forward to allow information integration from the embedded world to the cloud.

New members and new products are emerging as end users are looking for information solutions for IIoT, and the OPC UA technology is well-positioned to address the needs of the Internet of Everything.

Numerous organizations continue to partner with the OPC Foundation and/or develop companion specifications for their respective information models to seamlessly plug into OPC UA.

Organizations announcing releases of their companion specifications in 2016 for the OPC UA technology included:
• AutomationML
• PLCopen
• AIM
• VDMA: Injection Molding (status: release candidate)
• VDMA: Vision Cameras (status: in foundation)
• VDMA: Robotics, starting with the help of KUKA (status: in preparation)

VDMA is very active standardizing on OPC UA information models and expects to rollout a multitude of additional information models in 2017, leveraging OPC UA information integration communication as it’s strategy for seamless information integration and interoperability.

Board of Directors

Board members are elected as individuals for a two-year term. Elected to new 2-year terms were: Russ Agrusa, (ICONICS), Veronika Schmid-Lutz (SAP), Stefan Hoppe (Beckhoff) (also VP of OPC Foundation), and Matthias Damm (Ascolab). Also on the OPC Foundation Board of Directors are Thomas Burke (OPC Foundation), Thomas Hahn (Siemens) (also VP of OPC Foundation), Matt Vasey (Microsoft), and Ziad Kaakani (Honeywell) (also Treasurer of OPC Foundation), and Shinji Oda (Yokogawa).