Driven by this need, Nozomi Networks developed Guardian Air, the first multi-spectral wireless security sensor for the industrial sector, specifically designed for OT and IoT environments. Guardian Air is designed to prevent these disruptions before they happen.
The Guardian Air sensor continuously monitors wireless spectrum technologies between 800 MHz and 5895 MHz, including WiFi, Bluetooth, IEEE 802.15.4, LoRaWAN, Zwave, cellular networks, and drones. Guardian Air is a plug-and-play sensor that can be ready for operation in minutes. The data it collects, along with wired network and endpoint data, seamlessly integrates with the cloud-based management system Vantage, providing comprehensive visibility into what’s happening in your OT and IoT environments.
INVISIBLE ATTACK SURFACES: WIRELESS PROTOCOLS
Wireless communication remains one of the biggest, yet unresolved, threats to critical infrastructure security, from IoT devices to industrial control systems. Industrial environments rely on these technologies for everything from robots in manufacturing plants and drones monitoring pipelines in remote areas to systems that wirelessly manage energy consumption and building automation infrastructure.
Nowadays, not only Wi-Fi and Bluetooth, but also long-range technologies like LoRaWAN and cellular, Zigbee and 802.15.4-based building automation systems, and many wireless protocols such as Bluetooth, GPS, and WirelessHART are actively used in OT/IoT systems. These protocols are central to daily operations, but often remain invisible.
The proliferation of wireless protocols has created an invisible and poorly controlled attack surface, paving the way for a new generation of threats. These threats include methods such as unauthorized access, antenna-for-hire, segmentation hopping, jamming, interference, and evil twin attacks.
Moreover, these threats are not merely theoretical. Examples from Nozomi Networks customers show that some manufacturers integrated LoRaWAN devices into production lines for remote maintenance purposes, but failed to disclose the wireless capabilities of these devices to the asset owners.
Many wireless threats are only detected when devices are connected to a wired network. This means that threats can go undetected for extended periods, particularly in completely wireless systems, leading to potential damage.
WIRELESS FREQUENCIES AND PROTOCOLS USED BY GUARDIAN AIR
Guardian Air is capable of monitoring 6LoWPAN, Bluetooth/Bluetooth Low Energy @ 2.4GHz, Cellular, GPS, IEEE 802.15.4 @ 2.4GHz, ISA100.11a, LoRaWAN, MiWi, SNAP, Thread, WiFi, WirelessHART, Zigbee, and Zwave @ 800-900MHz wireless frequencies and protocols.
FIELD EXAMPLES AND REAL CASE STUDIES
These threats have serious consequences not only in the manufacturing sector but also in various other industries. For example, in a casino in Las Vegas, an internet-connected smart aquarium placed in the lobby was used by attackers to infiltrate the company network. In this attack, 10 gigabytes of data belonging to high-stakes customers were leaked. ( See .)
Another case was discovered in the summer of 2022 at a financial company on the East Coast of the United States, after unusual activity was noticed. Investigations revealed that the attackers attempted to infiltrate the company’s Wi-Fi network using modified drones equipped with Raspberry Pi and various penetration testing devices. ( See .)
In this and many similar cases, the lack of wireless network visibility means that by the time attacks are detected, it is often too late.
Attackers can infiltrate corporate networks not only through physical access but also remotely via wireless communication. A drone, mistaken for a camera, could actually be a cyberattack tool. Attack tools can be embedded within smart devices. Being able to detect such devices in their environment or visualize the area where they emit signals on a floor plan is of great benefit in preventing the threat.
GUARDIAN AIR: A NEXT GENERATION APPROACH TO INDUSTRIAL WIRELESS SECURITY.
Driven by this need, Nozomi Networks developed Guardian Air, the first multi-spectrum wireless security sensor for the industrial sector, specifically designed for OT and IoT environments.
Guardian Air does not emit signals or join networks; it passively monitors wireless networks and broadcasting entities with different protocols in the environment, providing instant and continuous visibility. The Guardian Air system creates an inventory of connected devices; classifies them as IT, OT, and IoT, and reports hardware brand, model, and operating system information.
This compact form factor device, operating over Power over Ethernet (PoE), mounts to the ceiling or wall and continuously monitors its surroundings. It does not connect to the system or send data; it only observes. Using triangulation with at least three sensors, it can determine the physical location of rogue devices and transmits all this data to Nozomi’s cloud-based management platform, Vantage.
Effectively detecting wireless threats requires more than just creating an asset inventory. It’s also necessary to identify suspicious devices that are broadcasting but not actually connected to the network. Guardian Air makes a difference in this area as well. It can detect evil twin attacks, brute force attempts, and physical layer attacks such as signal jamming.
GUARDIAN AIR: DETECTION, CLASSIFICATION, AND VISUALIZATION ALL IN ONE.
Guardian Air analyzes wireless traffic on the network, providing real-time and continuous visibility. It inventoryes connected devices, providing complete information such as which protocols are being used for communication and who is broadcasting.
Due to legal restrictions, device information is not collected on LoRaWAN and cellular protocols, but threats on these frequencies (e.g., fake base stations) can be detected.
The Guardian Air system not only detects but also classifies devices. It can separate networked devices into IT, OT, and IoT categories; and extract information such as brand, model, and operating system. In short, it answers not only “what’s there?” but also “where did it come from, what is it doing, and how risky is it?”. Additionally, it can detect devices entering restricted Bluetooth areas, monitor attacks on building automation systems, and generate alerts against long-range communication threats. The physical location of threats can be visualized using mapping such as blue dots for Wi-Fi and red areas for Bluetooth.
The Guardian Air system is centrally managed via the Nozomi Vantage platform; it monitors information such as sensor status, network structure, and signal strength, requiring zero configuration during installation. It is automatically configured and continuously updated.