̽»¨ÊÓƵ

Forescout eyeSight properly identifies and assesses all IoT devices on your internal network. Through Telnet, SSH,or SNMP scanning, Forescout can provide insight into factory-default or weak credentials and thereby automate policy actions to enforce strong passwords. Moreover, providing real-time insight into IoT devices' communication and risky behavior across the extended environment allows users to properly determine which IoTs are the riskiest and which might need extra segmentation controls. Forescout also has built in Botnet detection and continuous open port inspection to further neutralize outside threats attemping to compromise someone's network. Lastly, Forescout has insight into vulnerabilities present in the TCP / IP communication stack of IoTs. These vulnerabilities, termed Ripple20, are 19 vulnerabilities that affect hundreds of millions of IoT devices and include multiple remote code execution vulnerabilities. Forescout can easily detect and isolate devices that have these vulnerabilities present, thereby hardening an organization against outside forces.

Forescout eyeControl segments devices into trusted zones by enforcing least-privilege access by Zero Trust policy. Through agentless inspection, Forescout can extend Network Access Control to IoTs without exclusively relying on a MAC Address Bypass list. Forescout automates unified Zero Trust policy orchestration across multivendor environments and multiple network domains. This allows Forescout eyeControl to properly identify which IoT assets are non-compliant and then segment or block devices as needed.

Forescout eyeSegment and Forescout eyeInspect properly decipher what protocols are being used for network communication between various source and destination IPs. These connections are logged and used to augment segmentation policies to deny specific ports and services as needed. Moreover, Forescout is able to analyze packet hygiene to provide operational assistance for IoT devices. This allows teams to see which IoT devices might be dropping a lot of packets or failing, important when preparing for hardware refreshes. Lastly, Forescout eyeSegment can provide a Sankey Flow diagram to provide graphical views of network traffic and insight into possible network attacks.

Forescout eyeSegment maps data flows to design segmentation policies and simulate them for non-disruptive deployment. This traffic map not only provides a historical log of IoT network connections throughout the environment, but also diagrams all active connections by source and destination IP. This visualization is collected through Netflow which Forescout receives through a network TAP or SPAN port ingest on a switch. Once Forescout collects this network packet information, it can allow users to simulate Zero Trust IoT Segmentation policies before they go live, pivotal for non-disruptive implementation of network segmentation.

Forescout provides full coverage for OT devices with a fully passive and optionally active solution called eyeInspect that is able to provide visibility, the compliance status, and information about any anomalies both network or security related for every OT device on the network. With a detailed network map that showcases live connections by Purdue level and an extensive industrial CVE library, Forescout eyeInspect provides all the necessary tools for any OT security team. The product has an extensive case management system to assign certain tasks to individuals all with role based access controls for administrators or engineers. Lastly, Forescout eyeInspect provides network flow or Sankey diagrams to properly showcase different OT protocols and OT traffic across the environment. Forescout eyeInspect has support for over 250+ common and proprietary OT protocols to allow for compatibility and easy installation.

Forescout eyeControl provides granular host based and network based actions to block unauthorized devices, patch vulnerable devices, or quarantine guest devices. Forescout eyeControl gives users the abiltiy to remediate devices based on compliance issues or block unauthorized devices to reduce the chance of a breach. Lastly, eyeControl gives users a bunch of actions that they can select on a per-policy basis and the actions range from notification, to remediation, and even restriction. All of this is super important for Zero Trust as device control and remediation are key components within the pillar.

Forescout eyeExtend provides two separate forms of licensing for integrations with other existing cybersecurity investments: eyeExtend Connect and eyeExtend Ecosystem. eyeExtend Connect allows a user to download community made apps using open API and python scripting; it also provides the ability for an individual to make their own custom integrations. eyeExtend Ecosystem provides access to Forescout designed integrations with hundreds of different security solutions. Each integration provides bi-directional capabilities where Forescout can share its device information and take action based on triggers from other products. As a result, these integrations offer expanded automation in any environment which is a foundational piece of Zero Trust.

Forescout eyeInspect provides visibility for OT systems which is a crucial component for Zero Trust within the Device Pillar. OT or ICS / SCADA devices are very different than a traditional IT device like a server or computer. They utilize unique protocols, are usually legacy systems, and are very crucial to business operations so can't be taken down for patches or heavily scanned since it can overload the system. Forescout eyeInspect provides passive based and optionally active based protocol detection and traffic ingest of OT systems and utilizes that data to showcase traffic flows and plot vulnerabilities. It also provides alerts of attacks that might be happening in real time so a SOC team can properly respond and ensure that even critical infrastructure can be subject to Zero Trust requirements set forth in the Device Pillar.

Forescout eyeAlert is an extended detection and response solution that converts telemetry and logs into high fidelity, SOC-actionable probable threats. It automates detection, investigation, hunt for and response to advanced threats across IoTs, IoMTs, OT/ICS, and IT devices. All the functional capabilities of a modern SOC are rolled into the platform along with AI reporting to keep any team up to speed. Correlation of logs and reducing threats from the 1000s down to the top 10 most important alerts is crucial for any organization today while responding to active attacks. Zero Trust is all about assuming breach and constantly monitoring the environment while having tools to swiftly respond. Forescout eyeAlert provides those capabilities across the Device and Automation Pillars.

Forescout eyeFocus provides Risk and Exposure Management (REM) which is a key requirement in the Zero Trust Device Pillar. This comprehensive asset intelligence solution provides a foundation for understanding the security posture of your attack surface, through risk-based prioritization and persistent asset intelligence. With this solution, you get situational awareness of the cyber risk associated with every asset, and the ability to accelerate incident response for the msot vulnerable devices first. This not only enhances compliance assessment and remediation but also helps with automation, all of which are key characteristics for Zero Trust.