Zero Trust for Unmanaged Devices

The Zero Trust security model has become a mainstay of security approaches, but traditional Zero Trust controls largely overlook unmanaged and IoT devices. Armis can help.

DOWNLOAD THE WHITE PAPER

Never Trust, Always Verify

That’s easy to do for managed computers, but not for unmanaged and IoT devices like smart TVs, printers, VoIP phones, IP cameras, medical devices, and industrial devices. Most existing security products are blind to these types of devices which: 

  • Don’t support security agents
  • Don’t support patch management
  • Don’t tolerate network scanning
  • Don’t generate event logs
  • Commonly use Bluetooth and Zigbee
  • Often use dangerous Telnet or HTTP

Extend Zero Trust security to unmanaged and IoT devices.

Armis is the first agentless, enterprise-class security platform to address Zero Trust for unmanaged and IoT devices. The Armis platform provides passive, real-time and continuous asset inventory, risk management, and detection & response to prevent cyber attacks from disrupting and compromising businesses and operations. Armis uses 100% passive technologies so it is safe to use with IoT devices.

Accelerate adoption of Forrester’s Zero Trust eXtended Ecosystem, or ZTX, with Armis.

Zero Trust PillarArmis Capability

Devices

Armis provides the most comprehensive, unified asset inventory and device discovery available today. You see what each device is (make, model, location, and more) as well as the risks and software vulnerabilities on each device. Armis shares this information with your other Zero Trust systems to allow them to make better decisions about risk and network access.

Network

Armis lets you automate network segmentation by providing a wealth of information about every device in your environment including the device type, manufacturer, vulnerabilities, and each device’s communication needs. This information can be fed into your existing network infrastructure including firewalls and NAC systems. Once network segmentation has been established, Armis monitors actual traffic and alerts if/when unauthorized network bridges are created.

Visibility & Analytics

Armis monitors network traffic to detect behavioral anomalies, i.e. when a device is operating outside of its normal “known-good” baseline. This deviation can be caused by a device misconfiguration, a policy violation, abnormal behavior such as inappropriate connection requests, unusual software running on a device, or threat intelligence that indicates that the device has been compromised.

Automation & Orchestration

Armis works with your existing network, security, and management systems to trigger and automate incident response. Integrations include:
  • Wired network infrastructure (switches, routers)
  • Wireless LAN controllers
  • Cloud integrations such as Palo Alto Networks Cortex and Cisco Meraki
  • Firewall
  • Network access control (NAC)
  • SIEM
  • Vulnerability assessment
  • Ticketing and SOAR systems
  • CMDB and ITAM
  • Specialized systems such as the Check Point IoT Security Manager

Data

Armis monitors each device’s data transmission and alerts when sensitive data is sent without encryption. Armis detects and alerts on data exfiltration attempts.

People

Armis integrates with existing identity service providers and associates users with devices on your network. That helps threat hunters and IT support personnel identify the names of users who are behaving in risky ways, for example using malicious software or visiting dangerous websites.

Workloads

Armis discovers, classifies, and profiles both physical and virtual servers in on-premises and/or cloud environments. Armis monitors traffic between devices and cloud environments in order to detect behavioral anomalies or traffic patterns which could be indicative of a threat or data exfiltration.
Network Infrastructure

Frictionless Implementation

The Armis security platform does not require agents or additional hardware. Instead, it works with your existing network infrastructure, security, and management systems to collect the data it needs to discover, identify, and analyze the risk of all devices in your environment. The Armis platform collects data using a virtual appliance that sits out-of-band and passively monitors traffic. Since the platform is not in-line, it has no impact on network performance, other devices, or your users. It does not require any changes to your existing network, and it does not introduce any latency.

Armis fills the gap left by traditional enterprise endpoint security solutions.

EDR

Firewall

NAC

UEBA

EDR
  • Provides continuous monitoring and response for managed computers
  • Requires an agent
Armis
  • 100% agentless
  • Effective on managed, unmanaged, and IoT devices

Firewall
  • Protects the network perimeter and core
  • Focused on network traffic, not device behavior
  • No device knowledgebase
Armis
  • Protects devices at the access layer
  • Focused on device state and behavior
  • Deep understanding of device behavior

NAC
  • Assumes the network is trusted
  • Discovers devices on enterprise networks only
  • Can’t detect threats or compromised devices
Armis
  • Assumes Zero Trust
  • Discovers devices on network and in the airspace (Bluetooth, etc.)
  • Assesses device risk and threats

UEBA
  • Tracks the behavior of users
  • Looks for anomalies in user behavior
  • No device tracking
Armis
  • Tracks the behavior of devices
  • Compares behavior against our Device Knowledgebase
  • Understands “good” vs. "bad" behavior

Additional Resources

See Every Thing™

Every Device

Every Connection

See a live demonstration of the Armis agentless device security platform.

Request a Demo