SerialGuard functions as a fully passive serial packet sniffer designed for Industrial Control Systems (ICS) to monitor Level 0 and Level 1 serial communications between field devices and controllers. It provides secure visibility into vulnerable legacy networks, supporting protocols such as RS-232, RS-485, and RS-422. SerialGuard detects anomalies indicative of cyberattacks, physical attacks, or system misconfigurations, and can identify specific threats like Man-in-the-Middle attacks, unauthorized commands, and reconnaissance. The sensor is fail-safe, ensuring no disruption to operations during power failures, and encapsulates captured data into encrypted TCP packets for secure transmission to the Cynalytica AnalytICS Engine or other security tools. It is designed to meet monitoring requirements under DHS directives and is suitable for deployment across various critical infrastructure sectors, including energy, water, and transportation systems.
