A more connected world: why cybersecurity is no longer optional
We tend to talk about cybersecurity in the singular, but the truth is the concept is very broad, so it would be more accurate to talk about a company's different security policies and measures, in the plural.
Defending hybrid environments (where on-premises servers, cloud services, web applications, constantly evolving technologies, and industrial networks like the ones we explain in our article on OT systems and networks all coexist) is, without a doubt, a continuously evolving challenge.
IoT in companies: small devices, big risks
Within this broad landscape, it's becoming increasingly important to monitor IoT (Internet of Things) devices, which are already present in most homes, but also in practically every company. It matters because their presence keeps growing, meaning more and more IoT devices are connected to corporate networks.
We're talking about everything from PLCs, temperature sensors, IP cameras, climate control systems, and card readers, to smart shelving or RFID devices. Although we tend to associate IoT with home devices like smart bulbs, plugs, or voice assistants, its impact in the business environment is much greater. Corporate IoT devices often handle sensitive data, control processes, or grant physical access, and many of them don't receive updates or still use default passwords. This turns each small device into a possible entry point for an attacker, even when it looks harmless at first glance.
What a truly secure IT/OT network would look like
From Ewala's point of view, as a Managed Cybersecurity Service Provider (MSSP), in an ideal world a company would have two fully isolated networks (IT and OT), with the IT network segmented via its own VLAN for IoT devices, and an NDR deployed in OT that monitors network traffic, including traffic from the IoT devices on that network.
We would also have more layers of security across both environments, for example: a perimeter firewall, EDR on endpoints with an operating system, along with specific email protections (anti-phishing, sandboxing, anti-malware, etc.), a SIEM+SOAR that integrates and monitors all generated logs, backups, and a security team analyzing all this information in real time.
A SIEM centralises and correlates security events, while a SOAR automates the response based on them.
The real world: shadow IT/OT and poorly segmented networks
In an ideal world… but in the real world what we find are environments with more hops between the different networks than there should be, and where it's hard to find a network where every device is clearly IT or OT. On top of that, we usually don't have all the security layers we'd like, new devices are constantly being connected to the network, and we run into shadow zones (shadow IT/OT), that is, devices connected without the security team's knowledge or without proper management, and the challenge of "defending" starts to become quite complicated.
There are no magic solutions; what matters most is that company leadership becomes aware of the problem, and that companies start improving cybersecurity through regulatory control, because the first step to defending yourself is knowing what you need to defend (asset inventory) and how to defend it (Security Master Plan) and, very importantly, being aware of the investments this requires.
NDR: the missing layer to understand what's happening on your network
We started with IoT devices, talked about corporate networks and protection measures, and we want to end by focusing on NDR (Network Detection and Response).
An NDR is a solution that continuously monitors network traffic (east-west and north-south) to identify anomalous behavior, intrusions, or lateral movement by an attacker. Unlike traditional signature-based detection systems (such as an IDS/IPS), an NDR mainly uses behavioral analysis, artificial intelligence, and machine learning to detect unknown or advanced attacks.
A simple way to understand an NDR
A good way to understand it is to think of an NDR as a surveillance camera watching how devices on the network behave. It's not based on fixed rules, but on learning what's "normal" and alerting when something deviates from that pattern. Unlike a firewall, which controls what goes in or out, an NDR analyzes what happens inside the network to detect unusual movements, even when they don't resemble known attacks.
As we mentioned before, it's an additional layer of security, traditionally adopted more in OT, where it's hard to see what numerous legacy devices and/or devices without an operating system are doing, although it's becoming more common in IT too, which is why the best option is to analyze how they communicate with the rest of the network.
But the current reality is that IT also has many devices of this type, so NDR is starting to become a necessity in these environments as well.
Ewala's NDR: SentryN3t
At Ewala we've spent several years listening to the market and developing our own NDR technology.
As we said, it's important to know what to protect, so our NDR first performs continuous asset discovery.
We've seen that in OT environments there often aren't any IT technicians, which is why our console can be operated in a "user friendly" way by technicians at industrial plants, logistics warehouses, and so on.
We know security teams have many data sources to analyze, so our solution can integrate with practically any security console.
You can't protect your company with an NDR alone, but adding it to your security toolset will significantly increase visibility over your network and assets, and it will perfectly complement any other solution you already have deployed, so we strongly encourage you to learn more about these solutions because, as we said at the beginning, this business is a continuously evolving challenge, which means it's always necessary to explore new options and solutions to maintain or improve any company's security level.
By the way, our NDR is called SentryN3t, and it's developed entirely within the European Union, specifically in the Principality of Asturias.
IoT will keep growing… your security must too
Nowadays, many companies already have more connected IoT devices than traditional computers, which makes protecting this hybrid ecosystem an urgent need. Adopting technologies like NDR not only improves network visibility but also helps prioritize real risks and act before an incident impacts operations.
For more information or to see how it works on your network, request a demo or get in touch with us with no obligation.
