Cisco Cyber Vision Center Appliance M5S3 - Server - rack-mountable - 1U - 2-way - 1 x Xeon Silver 4210R up to - RAM 32 GB - SATA/SAS - hot-swap 2.5 bay(s) - SSD 4 x 400 GB - Pilot 4 - Gigabit Ethernet
-
Unique edge architecture
Easily deploy IoT/OT security at scale. Cyber Vision sensors are embedded in select Cisco networking equipment so you don't have to deploy dedicated appliances or build an out-of-band SPAN collection network. Cyber Vision hardware sensor lets you easily monitor industrial traffic on networks built with third-party equipment.
-
No network overload
No need for additional network resources. Cyber Vision sensors decode industrial network traffic at the edge and only send lightweight metadata to the Cyber Vision Center. This unique architecture only adds 2% to 5% load to your industrial network.
-
Global view on all your sites
Drive governance and compliance with detailed security information on all your industrial sites. The Cyber Vision Global Center seamlessly aggregates data from all local centers so that CISO and security teams have centralized visibility into assets and events per site and across sites.
-
Passive and active discovery
Cyber Vision monitors your industrial network by passively capturing and decoding application flows. This ultra-safe approach can be enhanced with active discovery that sends requests in the semantics of the specific ICS protocol at play to collect further information. The Cyber Vision active discovery mechanism is extremely precise and nondisruptive, and it can be activated for all or just parts of your network.
-
100% visibility
Only Cyber Vision's distributed edge active discovery can give you 100% visibility into your industrial network. It sends targeted inquiries to assets from sensors embedded in network equipment, so these messages are not blocked by firewalls or Network Address Translation (NAT) boundaries, resulting in 100% visibility.
-
Deep Packet Inspection (DPI)
Track the content of all application flows. Cyber Vision "understands" the ICS and IT protocols you use so it can profile your assets and detect abnormal behaviors or malfunctions.
-
Dynamic asset inventory
Build appropriate security policies and increase operational efficiency. Cyber Vision gives you real-time, detailed visibility into your industrial assets, their communication patterns, and application flows.
-
Map views
Visualize the activity of your control network. Cyber Vision offers several types of maps to show your assets and their communications. Quickly spot threats and anomalies, thanks to color coding.
-
Document zones and conduits
Easily build security policies. Cyber Vision lets you group assets into zones (production cells, buildings, substations, etc.) so OT can share logical network information with IT and build security policies according to IEC 62443.
-
Operational insights
Maintain process integrity by tracking unexpected variable changes and Programmable Logic Controller (PLC) program modifications. Cyber Vision supports operations to work more efficiently and with reduced risk.
-
OT tags
Immediately understand the role of each device and what it is doing. Cyber Vision translates application flows into human-readable tags, so you know what is going on, even if you're not a protocol expert.
-
Preset views
Easily dive into your dataset by using preset and custom views that highlight what really matters to you, helping you focus your detection strategy and share targeted information with colleagues.
-
Security insights
Quickly understand your current security status, identify anomalies and vulnerabilities, and respond to threats. Cyber Vision offers various dashboards, reports, and event histories to easily spot security issues and share information with all stakeholders.
-
OT flight recorder
Meet compliance requirements. Cyber Vision maintains the history of all events and application flows, including variable accesses, so you can easily run forensic searches and build incident reports.
-
Vulnerability detection
Keep your industrial assets safe. Cyber Vision alerts you to hardware and software vulnerabilities that need to be patched.
-
Intrusion detection (IDS)
Uncover the cybersecurity threats coming from your IT network. Cyber Vision integrates the Snort IDS engine leveraging Talos subscription rules to detect known and emerging threats and keep you protected.
-
Anomaly detection
Keep your ICS safe from unknown attacks and malfunctions. Detect illegitimate modifications to your industrial assets and processes such as unexpected program downloads or variable changes.
-
Baseline monitoring
Detect deviations to expected process behaviors. Automatically create baselines to profile your industrial operations and define what normal should be. Create multiple baselines to focus on what is most critical to you (such as a particular asset), detect specific behaviors (such as remote access), or enable accurate detection and minimal false positives (such as during maintenance operations). Deviations immediately trigger alerts.
-
Manage OT security events
Enable IT/OT event correlation. Cyber Vision can automatically forward OT events and alerts to SOC platforms such as Security Information And Event Management (SIEM) and Security, Orchestration, Automation, and Response (SOAR) systems. To avoid event fatigue, it even lets you choose which event types should be shared.
-
IT/OT collaboration
Leverage OT knowledge of industrial assets and processes. Cyber Vision helps build a collaborative workflow between IT and OT to efficiently secure production. OT can report security events by providing additional context. IT can add custom properties to OT assets and groups to document specificities, dependencies, and stakeholders.
-
Extension of IT security to OT
Build a unified OT/IT SOC. Cyber Vision is fully integrated with Cisco IT security platforms and feeds them with rich details on OT assets and events. Creating OT security policies and remediating threats using existing IT tools is now much easier.
-
Rich integration with IT
Easily share OT context with your IT tools. Cyber Vision comes preintegrated with many third-party security tools (firewalls, configuration management databases, etc.) and has a rich REST API to build your custom integration. The API Explorer helps you write and test API calls via a friendly user interface and comes with code samples to get you started.
The deeper integration between IT, cloud, and industrial networks is exposing your Industrial Control Systems (ICS) to cyber threats. As you begin to capture the benefits of your industry digitization efforts and start deploying Industrial Internet of Things (IIoT) technologies, you need a cybersecurity solution to help you ensure the continuity, resilience, and safety of your industrial operations.
Cisco Cyber Vision has been specifically designed for industrial organizations to gain full visibility into their industrial networks, so they can detect threats, ensure process integrity, build secure infrastructures, drive regulatory compliance, and enforce security policies to control risks.
Cisco Cyber Vision combines a unique edge monitoring architecture and deep integration with Cisco's leading security portfolio. Built into your Cisco industrial network equipment, it can be easily deployed at scale to monitor your industrial assets and their application flows in real time. It is the ideal solution to feed your IT Security Operations Center (SOC) with OT context, so you can build a unified IT/OT cybersecurity architecture.
- Unique edge architecture
- No network overload
- Global view on all your sites
- Passive and active discovery
- 100% visibility
- Deep Packet Inspection (DPI)
- Dynamic asset inventory
- Map views
- Document zones and conduits
- Operational insights
- OT tags
- Preset views
- Security insights
- OT flight recorder
- Vulnerability detection
- Intrusion detection (IDS)
- Anomaly detection
- Baseline monitoring
- Manage OT security events
- IT/OT collaboration
- Extension of IT security to OT
- Rich integration with IT
