Features

Protect Vulnerable Controllers
The PLCs, DCS, IEDs and RTUs in control networks are optimized for real-time I/O performance, not for robust networking connections. Even normal network traffic, like broadcast and multicast messages, can overload some devices and cause them to crash. Tofino makes it easy for the control technician to define rules that specify which network devices are allowed to communicate, and what protocols they may use. Any network traffic that does not fit the rules is automatically blocked by the Tofino SA and reported as a security alert.

Protect Vulnerable Controllers

The PLCs, DCS, IEDs and RTUs in control networks are optimized for real-time I/O performance, not for robust networking connections. Even normal network traffic, like broadcast and multicast messages, can overload some devices and cause them to crash.

Tofino makes it easy for the control technician to define rules that specify which network devices are allowed to communicate, and what protocols they may use. Any network traffic that does not fit the rules is automatically blocked by the Tofino SA and reported as a security alert.

Improve Network Segmentation
Many control systems have evolved from simple, stand-alone systems to complex interconnected networks. These networks are typically unprotected with no isolation between different sub-systems, so if a problem occurs in one area, it can quickly spread throughout the network. The Tofino SA is the ideal solution for segmenting a control network into security zones. It is installed into an existing system with no changes to the network, forming 'conduits' of communications between the zones. The control engineer defines rules that specify which network devices are allowed to communicate and what protocols they may use.

Improve Network Segmentation

Many control systems have evolved from simple, stand-alone systems to complex interconnected networks. These networks are typically unprotected with no isolation between different sub-systems, so if a problem occurs in one area, it can quickly spread throughout the network.

The Tofino SA is the ideal solution for segmenting a control network into security zones. It is installed into an existing system with no changes to the network, forming 'conduits' of communications between the zones. The control engineer defines rules that specify which network devices are allowed to communicate and what protocols they may use.

Guard Against Accidental and Malicious Intrusion
Even if your control network does not connect to the Internet, you are still at risk. Studies show that the vast majority of cyber security incidents originate from a variety of secondary points of entry into the network, including the enterprise network, maintenance connections, third-party networks (such as partner companies and contractors) and even transient sources, such as laptops and USB storage devices. A security risk assessment, combined with Tofino's Zone Level Security strategy, identifies potential threat sources and entry points and isolates those points. If an attack does originate from a secondary entry point, the potential damage is easily contained within the zone in which the attack originated.

Guard Against Accidental and Malicious Intrusion

Even if your control network does not connect to the Internet, you are still at risk. Studies show that the vast majority of cyber security incidents originate from a variety of secondary points of entry into the network, including the enterprise network, maintenance connections, third-party networks (such as partner companies and contractors) and even transient sources, such as laptops and USB storage devices.

A security risk assessment, combined with Tofino's Zone Level Security strategy, identifies potential threat sources and entry points and isolates those points. If an attack does originate from a secondary entry point, the potential damage is easily contained within the zone in which the attack originated.

Installation
Plug-n-Protect installation to an operating control network with no pre-configuration, no network changes, no disruption to network traffic and no downtime

Configuration Modes
Network: The Tofino Configurator uses the Tofino NetConnect LSM to securely communicate with the Tofino SA over any network Manual: Encrypted configuration files may be saved on a USB storage device and loaded into the Tofino SA via a secure USB port

Operating Modes
Test: all traffic allowed; alerts generated as per user rules Operational: traffic filtered and alerts generated as per user rules

Mode Changes
Operating mode is controlled remotely from the free Tofino Configurator software

Security Alerts
All alerts are reported to the Tofino Configurator via optional syslog reporting

Diagnostics
Simultaneous event logging to a remote syslog server and local nonvolatile memory for later download via network or USB storage device

Status Indicators and Controls
Status indicators: 'Power', 'Fault', 'Mode' Traffic indicators: link status, speed and activity for each Ethernet port Pushbutton loads configuration from encrypted files or saves diagnostics to USB storage device

System Requirements
Tofino Configurator Loadable Security Modules (LSMs) to implement the desired security features

Tofino Product Series - 5 Product Lines to Meet your Needs

All Tofino Security Appliances have the features shown above, however, each series of Tofino Products has different specifications in the areas of configurability, connectivity, temperature ranges, power supply and approvals.

PDF Tofino Xenon Security Appliance Data Sheet

Tofino Pre-defined Protocols, Controllers, Apps

Search form

menu-bar

Features

Tofino Product Series - 5 Product Lines to Meet your Needs