Gateway Edge

A plug-and-play, Industrial gateway form factor, providing secure connectivity for OT, IoT and IT devices as well as legacy infrastructure.

It makes endpoints invisible on the network through microsegmentation. It physically isolates and protects endpoints from the local network and provides traffic route enforcement.

Each Edge in the Byos network creates the tunnel with our cloud-based control plane, not with each other across the LAN. All traffic is routed centrally through our cloud before reaching any edge. However, we do offer the option of deploying an on-prem control plane with larger rollouts, that way the traffic will still stay inside your perimeter.

Byos does not allow traffic outside the overlay, because that is the main way to exploit lateral movement to spread the attack surface after a breach. If this is really a need for you, we should discuss the implications before considering enabling that feature for you.

Each edge is technically firewalling and subnetting the edges inside of it’s microsegment, so everything inside the microsegment is visible to each other. If you want to have more granular control, you’ll need to deploy on a 1:1 basis where the HMI and the workstation have their own gateway edge. Then you can restrict traffic on a port/service basis between the edges through our Secure Lobby overlay. As an example, the policy could be that HMI can only be reached over Port 1025 using service X and Workstation only has SSH/22, RDP/3389, and HTTP/80 enabled.

Security-wise, what Airgap.io does is gives all the assets a 32 bit mask, which isn't really microsegmentation. By giving everything a 32 bit mask, you are initially forbidding them from communicating with the router directly. It is a poor mans way of "isolating" every asset and a simple way to prevent cross-talk, but it is tedious to manage (and adds latency). On the surface, each asset is in it's own 'network' but are only isolated at Layer 3 - there is no protection at layer 2, and nothing at layer 4. Implementing Airgap.io would still require investments in perimeter network security offerings. Byos protects across Layers 2-4 in a single solution that doesn't require changing how the underlying networking gear on the local network.

Aside from purely security benefits, Airgap.io doesn't provide:

We learned the direct ROI saved by Manufacturers deploying Byos was two fold:

The core issue that plagues traditional networking products is that they work as point solutions, increasing the overhead needed to manage them.

The eWon Cosy is no different - it is simply a hardware VPN device that enables remote access into a network.

Byos has taken a different approach - our microsegmentation solution was built as a security solution first - it makes the assets invisible to lateral movement on the network. This satisfies the IT security appetite for hardening their OT environment.

Given Byos’ position at the edge, it controls all ingress/egress traffic for the assets. This means that specific and granular secure remote access is a resulting capability, with the basis of security covered before letting a single packet through. Byos lets Admins control the “who, what, when, and how” of remote access, ensuring that access is only granted to the specific asset inside of the microsegment.

The key difference between generic remote access technologies and what Byos offers is that, once a 3rd-party is granted access, they are never on the underlying network; they are only on the Byos overlay network. The Byos overlay specifies which port and service they can only access, but is Layer 7 IP protocol agnostic. However, Byos ensures the 3rd party does not have visibility to any other asset that might be connected to the facility’s local network.

In addition, the Byos solution maintains “plug-and-play” simplicity on deployment, activation, and management, so that additional networking complexity is avoided altogether. No local networking changes needed, and easy integrations with other TCP/IP based technologies.

The beauty of having a protection mechanism that is decoupled from the asset itself, is that no matter what comms the asset tries to establish, the protection mechanism will be able to stop it. BYOS isn't a malware infection prevention tool - we leave that to EDRs and anti-phishing tools. But from a discovery/reconnaissance/lateral movement perspective post-infection we give the attacker no information, making the ROI on attack much less to a point where it becomes uneconomical to continue.

In the case of connecting BYOS to assets that have already been infected before deploying BYOS, those assets are going to try to continue their comms either to C2 or to the rest of the network, BYOS is going to stop it at the edge. It will never reach the network itself. You can do this on BYOS through policy management, geo-blocking, or simply applying specific routing policy rules on the network, to not permit a specific type of traffic from leaving the Edge.

However, way beyond that configuration piece, BYOS by design does not allow lateral movement, network scanning, or any type of discovery traffic to leave the edge, and will not respond (on both WAN and LAN side of the Edge) with any sort of information or intelligence on what the network looks like.

If the Malware is sitting on the asset side then it’s gonna try to get out and talk to other devices, but BYOS is not going to let it happen. BYOS is also not going to give the Malware any sort of information about what devices are out there. If the Malware is inside the Firewall, then it won’t be able to see any valuable information about the network itself because everything is going to be encapsulated and encrypted in the Layer-2 tunnel that BYOS establishes.

Malware at the Cisco layer will see gibberish and won’t be able to do anything with it, and Malware at the asset layer won’t be able to get anything out of BYOS to run its attack. And because BYOS runs decoupled from the asset, without any drivers, agents, or software in it, the compromised asset won't be able to kill/disable the BYOS protection.

Competitive Advantages