Enhancing Industrial Automation and Control Systems Cybersecurity Using Endpoint Detection and Response Tools

In today's rapidly evolving cybersecurity landscape of industrial automation and control systems (IACSs), threat detection and prevention are more critical than ever. Compared to information technology (IT), the cybersecurity maturity of IACS is still low. Therefore, one way to increase the cybersecurity of IACS is to adopt and implement proven IT protection methods. Endpoint detection and response (EDR) and extended detection and response (XDR) tools have emerged as the means of protecting IT systems. Their exceptional threat detection, analysis, and response capabilities make them indispensable components for protecting critical infrastructures. The paper addresses the potential integration of EDR and XDR tools into IACS environments to strengthen their cybersecurity and protect them from new and existing threats. To demonstrate the feasibility of such a solution, we have implemented a chosen EDR tool on an industrial programmable logic controller (PLC). We have also analyzed the impact of such a solution on real-time PLC performance, which shows that such tools could be implemented in real-life IACSs.