Q-Net Security ads

Two French supermarkets lost €270,000 in a single night. The device that would have protected them costs less than $6k and drops inline in minutes. What is your OT security worth?

"There is a real risk that Chinese hackers will one day try to interfere with the grid, but the risk is not inherent to a “made in China” sticker. It comes from what a component can do and who can control it. " The New York Times published an article discussing the national threat lurking in the hardware many deploy. The simple fact is many of the components used to control Solar, Battery and Wind farms are made outside of the US, and allow third parties to remote in. How do you explicitly allow who you want in, and stop those "Call Home" scripts from running? You put hardware in front that can't be manipulated, can't be bypassed, and doesn't need weekly security patches. Why? because the cost of these going down is only part of the story. Once on your network, those attackers own your network. Q-Net does this for you, at a fraction of the cost of others. Let's talk. Let's secure our grid together. Link to Article in comments. #Solar #CriticalInfrastructure #SecureGrid #HardwareSecurity

A mid-size city can have several hundred signal cabinets on the street, and the key that opens them rides on a lot of key rings. That's normal and it's how crews get work done. But it also means physical access to a cabinet has usually meant network access to the corridor, which is a tough thing to unwind when the controller inside is a decade old and running timing plans nobody wants to mess with. Our fix is tidier than most people expect. Our hardware encryptor mounts on the shelf next to the controller, pairs that cabinet to the traffic management center and to nothing else, and leaves the addressing and NTCIP configuration alone. An opened door now reaches the controller in front of it and stops there. The policy gets written once for a device class, and every cabinet that joins inherits it. Q-Net Security has that pattern documented along with four others for state, local, and education agencies, covering water, municipal electric, CJIS interconnects, and school districts. If you run a signals program, let us hear which devices you prioritize protecting, or you know, let us help secure them! #SmartCities #ITS #OTSecurity #SLED

A remote substation, a storm truck and a nuclear switchyard have the same encryption problem. Different equipment, different regulators, same topology. Something at the head end, something at the far end, and a circuit in between that somebody else likely operates. We drew up the six ways we solve the biggest problems: 1. Remote transmission substations. Medium-impact BES Cyber Systems on leased fiber, LTE and satellite, one pairing per site. 2. Control Center to backup Control Center. ICCP, synchrophasor and EMS replication on diverse paths, each path keyed independently of the other. 3. Mobile restoration fleets. Trucks and deployable kits on whatever transport the storm left standing. Access rides on enrolled hardware instead of a credential on a crew laptop. 4. Distributed generation and renewables. Low-impact sites with nobody on site, plus OEM and integrator access authorized per site and revoked in one action. 5. Nuclear balance-of-plant. Switchyard and transmission interface on the NERC side of the 10 CFR 73.54 seam, management plane on premises, no internet path required. 6. Behind-the-meter generation for hyperscalers. Generation operator, data center EMS, interconnecting utility and RTO on one project, each relationship a separately keyed tunnel. The campus sees its own telemetry and nothing more. The reason to look now? 4,407 controllers were reachable from the open internet on August 3, seven plus states have reported operational impact to the FBI since late July, and BOD 26-02 is retiring the end-of-support edge devices carrying this traffic today. Pretty heavy reasons to refocus on your security! A Q-Box adds no patchable asset, no certificate to manage, and no pre-shared keys to worry about exchanging. Keys rotate in silicon. There is no handshake in the stream to capture, so traffic recorded today stays unreadable once quantum computing matures. Less than $6k per Q-Box at list. Install is a bracket, two cables and power. Designed and built in the USA. Message us for the architecture set. #NERCCIP #GridSecurity #OTsecurity #CriticalInfrastructure

Nobody decides to leave forty substations unencrypted. Their budget decided it for them. Let's fix that. The two or three circuits an auditor will ask about get protected. Then the per-site number meets the site count, the program stops there, and everything else stays on a leased circuit and a handshake. That gap got expensive this summer, and the cost of delaying securing that gap is growing. Forescout found 4,407 controllers reachable from the open internet on August 3, 2,844 of them in the US. Utilities in at least seven states have reported operational impact to the FBI since late July. And BOD 26-02 now has federal agencies pulling end-of-support firewalls, routers and VPN gateways off their networks, which is the same equipment carrying a lot of this traffic right now. We priced the Q-Box for fleet coverage and removed the patching requirement. Enterprise security without the inflated costs. Less than $6k at list, with no discount cycle to negotiate through. $500 a month for the policy console. Ten-year service life against roughly five for a software firewall, and nothing on the data path to patch or renew. Install runs minutes per site. No re-addressing, no routing redesign, no application changes. Policy pushes to the whole fleet from one console in minutes, which is what matters when a vendor account has to come off at 2am. Six reference architectures cover the sector as it actually looks: transmission substations, Control Center to backup Control Center, mobile restoration fleets, distributed generation, nuclear balance-of-plant, and behind-the-meter generation serving hyperscale load. Designed and built in the USA. Message us for the set and the TCO comparison. #NERCCIP #GridSecurity #OTsecurity #Utilities

2,844 industrial controllers in the US are sitting on the open internet. Yikes! Forescout counted them on August 3. Over roughly the same stretch, utilities in at least seven states told the FBI they had lost visibility or control of equipment. Operators locked out of their own PLCs. IP addresses changed underneath them. Long runs of manual operation. Nobody had to exploit a vulnerability to do it. The actors connected with the same engineering software a technician uses, over circuits that were reachable to begin with. The federal advisory has since widened past Rockwell to Schneider Electric and Siemens, and it names energy alongside water. Meanwhile BOD 26-02 has federal agencies pulling end-of-support edge devices off their networks. Firewalls, routers, VPN gateways. The same class of box carrying encrypted operational traffic at most utilities today, each one with a patch window, a certificate renewal, and the downtime to your gear to accommodate those actions. The Q-Box takes all of that off the calendar. Fixed-function silicon on the data path, so there is nothing to patch. Keys are auto-generated and rotated in hardware, so certificates are a thing of the past and static keys will never get forgotten and left for years in prod. AES-256-GCM encryption coupled with auto-rotating randomized keys based on configured packets passed (1-255) means a recording made today does not become readable later when quantum computing catches up. We built six reference architectures around how the sector actually runs: 1. Remote transmission substations 2. Control Center to backup Control Center 3. Mobile restoration fleets and field crews 4. Distributed generation and renewables 5. Nuclear balance-of-plant and offsite links 6. Behind-the-meter generation for hyperscalers Install is a bracket or even a shelf, two cables and power. Pairings are set in the policy console before a crew leaves the yard, and cutting a vendor's access is a click instead of a truck roll. Less than $6k per Q-Box at list, same number for everyone. That price is what lets a utility cover the whole fleet instead of the six links an auditor will ask about. Designed and built in the USA. Message us for the architecture set. #NERCCIP #OTsecurity #GridSecurity #CriticalInfrastructure