Hide and Protect
Make the equipment invisible to unauthorised users
The Lock receives all traffic on its way to the equipment. It lets through only traffic from someone with a valid key. It stops everything else and does not even respond to it.
What happens
The equipment becomes invisible to unauthorised users
An attacker often starts by scanning the network for equipment that responds. The equipment then reveals that it exists, and often what kind of equipment it is. Behind a Lock, the equipment responds only to someone with a valid key.
It does not show up in scans
Tools that scan the network get no response. It looks as if the equipment is not there.
It does not respond to ping
Ping is a simple way to check whether something exists at an address. The Lock does not respond.
Unauthorised users cannot reach it
Malicious software on a computer without a valid key cannot get through to the equipment.
Everything is denied by default
The Lock lets through only what an access rule explicitly allows. It stops all other traffic.
When the function fits
Equipment that you cannot change
Hide and Protect fits when you need to protect equipment that you cannot change. Here are some examples.
Control systems and operator computers
Many control systems run on computers that no longer receive security updates. The Lock protects these computers without any change to them.
Certified equipment
For some equipment, every change has to be checked and approved again. The Lock sits outside the equipment, so the equipment itself stays unchanged.
Measurement and analysis instruments
Instruments with a network connection are rarely updated. They are often connected to the same network as the office computers.
Cameras and alarms
Cameras often have weak passwords and software that is rarely updated.
Networks without division
One Lock can protect several machines or a defined part of the network. That lets you start dividing the network today.
Remote sites
Pumping stations, substations and similar sites are often connected through a shared network or the internet.
How authorisation is decided
The Lock trusts keys, not addresses
An ordinary firewall lets through traffic from certain addresses on the network. So an attacker who takes over such an address also gets through.
XoT works differently. Every user and every device has its own digital certificate, a kind of identity document. The Lock lets through only traffic from someone who can present a valid certificate. So an address on the network is not enough to get in.
The user and the Lock check each other twice a minute while the connection is open. An authorisation you revoke stops working at the Lock immediately.
Common questions
Do we have to install anything on the equipment?
No. You install the Lock next to the equipment. The equipment itself stays unchanged.
Do we have to change the network?
No. The equipment keeps its address on the network, and you do not need to rebuild anything.
How many machines can one Lock protect?
One Lock can protect a single machine, several machines, whole subnets or several VLANs at the same time. Subnets and VLANs are two ways of dividing a network into smaller parts.
Can we control which traffic is let through?
Yes. You decide who may connect, to which equipment, from where and when.
Can we combine it with Remote Access?
Yes. Both functions are in the same Lock. You pay a licence for each function you use.
Start with the machine that worries you most
We will help you put a Lock in front of it. You do not need to change anything in the network.