Managing technologies

In the web interface of Kaspersky Industrial CyberSecurity for Networks, you can enable or disable the use of technologies, and change the operating mode of technologies. Only users with the Administrator role can manage technologies.

The following technologies and methods can be enabled and disabled:

• Network Control technologies:
  • Network Integrity Control
  • Command Control
• Asset Management methods:
  • Asset activity detection
  • Asset Information Detection
  • PLC Project Control
• Unknown Tag Detection based on Process Control technology
• Intrusion Detection methods:
  • Rule-based Intrusion Detection
  • ARP spoofing detection
  • IP protocol anomaly detection
  • TCP protocol anomaly detection

If a technology or method is disabled, the application does not monitor communications of assets using this technology or method. However, you can configure the settings of disabled technologies and methods (for example, add or edit rules).

The mode can be changed for the following technologies and methods:

• Network Integrity Control
• Command Control
• Asset activity detection

After the application is installed, all technologies and methods (except PLC Project Control and Unknown Tag Detection) are enabled by default. Learning mode is enabled by default for technologies and methods whose mode can be changed.

To change the state and/or mode of technologies and methods:

1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server through a web browser using the account credentials of a user with the Administrator role.
2. Select the Settings section and go to the Technologies tab.

   You will see a list of technologies and methods whose states and modes can be changed.

   If the states or modes of technologies and methods cannot be changed at the current time, the toggle switches in the list are not available (the No data value is displayed in the mode selection fields). In this case, it is recommended to check the status of the kics4net service on the Server computer. If the service is not active, you must start it.

3. Use the toggle switches on the left to enable or disable the use of relevant technologies and/or methods. To enable or disable all technologies and methods simultaneously, use the Activate all or Deactivate all button.
4. After enabling or disabling a technology or method, wait for the changes to be applied. The toggle switch is unavailable until it is finished moving to the other state.
5. If Network Integrity Control technology, Command Control technology, or the Asset Activity Detection method are enabled, select the necessary mode. To do so, in the drop-down list on the right of the name of the technology or method, select one of the following options:
   • Learning – to apply the technology or method in learning mode.
   • Monitoring – to apply the technology or method in monitoring mode.

   To change the mode of all enabled technologies and methods simultaneously, use the Mode drop-down list.

6. After selecting a mode, wait for the changes to be applied. Until the mode is changed, the drop-down list displays the Changing status.

   If you selected different modes for enabled technologies and methods, the Mode drop-down list displays the Mixed value.

Page top