Armexa Delivers New Tool for OT Cyber Resilience

Summary

On 31 July 2024, Houston-based Armexa announced the launch of its Industrial Resiliency Integrated Solution (IRIS) Operations Platform. Armexa is a cybersecurity company that specializes in helping industrial companies achieve secure, safe and resilient operations. Armexa developed the IRIS platform to address the needs of industrial operators that lack dedicated operational technology (OT) support staff.

“IRIS offers a practical, scalable approach that allows asset owners to achieve a high level of protection without an expensive initial remediation effort,” said Eric Forner, Armexa co-founder and CTO. “It brings focus to what industrial operators are doing, what they aren’t doing, and what they should be doing when it comes to OT security.”

IRIS is a turnkey solution that blends technologies and services specifically tailored to OT environments and their specific challenges. “It focuses on addressing the gaps we often see when performing risk and gap assessments in industrial facilities,” Forner explained. “The gaps we often see are around a robust backup/recovery capability, secure remote access, PLC [programmable logic controller] configuration management and infrastructure monitoring. Even if some of that technology is deployed in the OT environment, it really takes continuous care to ensure that the systems are working properly and providing the protection the products claim to offer. This is why the IRIS Operations Platform includes continuous monitoring, configuration management and site visits to ensure the technology investment is providing all the resiliency benefits possible."

Tailored to OT environments

Forner said the key differentiator for IRIS is not just the technology. It’s also the people supporting it. “Armexa is focused solely on OT environments, and all the folks that work here and support IRIS installations have worked in OT and understand the challenges. From a people standpoint, we focus on close interaction with operations staff through in-person interactions that build trust when introducing new technology into the facility. All our staff are U.S.-based; they have been to industrial facilities, understand the risks and limitations of working on or in OT environments, and can speak the language of plant floor operations that is distinct from IT [information technology],” he said.

“We have processes in place that align to that of an operating asset,” Forner explained. “For example, we follow the MOC [management of change] process that may be enforced at an operational level and work with OT vendors to only apply patches that are included in their qualified patch list. These things may be a non-issue in IT environments, but because we understand the processes in place for OT, we tend to follow them to keep things running smoothly.

“From a technology standpoint, we use technologies that have been vetted thoroughly in OT environments. As a matter of fact, the technologies IRIS uses are those that we’ve evaluated and deployed already in OT environments on behalf of our customers. The technology supports common use cases we’ve seen all the time in OT such as vendor/SI [system integrator] temporary remote access to troubleshoot issues, network infrastructure management of OT-specific network devices, and backup/recovery technology that works well in bandwidth restricted locations.”
 

How IRIS is deployed

IRIS uses a combination of on-premise and cloud-based software. To ensure scalability, some components are cloud-based and all are vetted with the appropriate SOC2 certifications. “Other components are on-premise at the customer facility, particularly components that can have particularly sensitive data or data streams that could consume too much bandwidth in remote locations,” Forner said.

“The idea for IRIS is that the solution is turnkey, in that the customer doesn’t have to worry about software licensing, support, configuration, administration and management,” Forner continued. Armexa takes care of all of that on behalf of the customer. Armexa offers U.S.-based support with regular trips to the facility to perform onsite maintenance and meet with facility staff. Day-to-day support, monitoring and administration are accomplished remotely using secure channels. Customers are offered regular reports of their IRIS infrastructure and can see the internal dashboards we use if they’d like to take a deeper dive.”
 

Always OT-focused

The biggest thing is that Armexa has been focused on OT since its inception. “We started out assessing OT environments and designing/deploying OT technologies,” Forner added. “The one thing we found is that once the deployment is complete, we ‘hand over the keys’ to the customer and many times they didn’t have the time or expertise to maintain the infrastructure. We get it, many times OT cybersecurity is somebody’s ‘other job’ and the technology itself can be very complicated. We haven’t found any technology that is truly set-it-and-forget-it. These challenges were really the genesis of developing IRIS to help our customers remain resilient throughout the lifecycle of their facilities without burdening staff with additional responsibilities and a new tech stack to maintain. We really want to make it as frictionless as possible to ensure resilient and secure OT environments, and we think IRIS is a great way to help our customers get there.”