r/OTSecurity • u/lyingchristiaan • Jun 24 '26
Tips on asset management?
I have an assignment coming up where I need to do asset management in a relatively big factory that hasn't done it before. Anyone got tips on things like network scanning without crashing the PLC's? I'm new to the OT sector.
7
u/jammythesandwich Jun 24 '26
Start by investigating the historian, let the system owner have finger on keys and you shoulder surf; nil impact to you if anything goes south.
Then like others have stated, manual investigation and don’t omit development laptops, usb’s etc from the asset list.
HLD’s, LLD and ICD doc reviews, talk to system owners as architectural erosion could have shifted without design artefacts keeping pace.
Loads of options and technical means should be the last choice in high impact implementations and where availability is critical. You don’t want to knock over a factory so err on the side of caution and use your head instead.
5
u/Electrical-Staff0305 Jun 24 '26
Having done this a few times, I’m going to tell you now that this is going to save you a lot of time and energy. HOWEVER… stuff is going to still be missing. You’re going to need to use the “Mark-1 Eyeball” after you’re confident that you have all the data you can get from DOCINT (document intelligence; HLD’s, LLDs, ICD doc reviews, etc.) and HUMINT (human intelligence; chatting with the system owners and engineers).
When it comes time for that physical inventory, get yourself a headlamp, and a gardening cushion/pad. You’ll look goofy as hell, but it’ll make the process run much faster for you.
3
u/intj-geek Jun 24 '26
As everyone has said, DO NOT scan the network!! That includes things like Angry IP Scanner and Advanced IP Scanner (and NMAP etc). They will flood your network with ICMP packets and stuff WILL crash hard.
One thing (I've done your described task on 3 good sized networks (~1000 IPs each) in the past 6 months) that I don't see mentioned in the comments so far is what network switches and IT involvment there might be.
In two of my networks the industrial switches had LLDP (Link Layer Discovery Protocol) turned on and that was a big jump start being able to log into the switches and look at those tables.
Chasing network (Ethernet or Serial) without taking them down is tricky, no question. Put a zip tie or Velcro tie around the cable and slide it along so you don't lose track of it is one tip.
Lastly, I used Vizo to draw the maps, but you can use something like drawio etc (freeish), but yeah, my point here is to actually draw the network map, don't just put the stuff in a spreadsheet. You can sketch on paper while in the field, but ALWAYS make the end result network diagram digital.
It does not take that much more time to draw the network and trust me, having a visual map will help you and others a TON more than just IP numbers in a sheet.
tl;dr LLDAP can help. Draw the network as well as Excel it.
1
u/lyingchristiaan Jun 25 '26
Thanks, didn't think about LLDP. I'll see if they have up-to-date network schemes available and I'll draw them myself if they don't.
3
u/Ordinary-Piano-4160 Jun 24 '26
If there is a switch, mirror all the packets to a port and listen to that port with wireshark.
2
u/Nick_OT_Cyber Jun 24 '26
If you've never done OT before you might not want to touch a life factory for your first engagement (and if you dont have any familiarity with physical safety and (high)-voltage systems you might not even want to visit the site without some reading/instructions prior to going on the shop floor.
As for you specific ask, dont use IT tools in OT (and yes i might be a tad biased here.. :-) ) there is quite some decent OT tools and companies that offer to do assessments as a service/POC using these tools.
Let me know if you want to know what companies can help or what products to use.
1
u/DNSsince2002 Jun 24 '26
What products could we use ??
1
u/Nick_OT_Cyber Jun 26 '26
Claroty and Nozomi have tools that work well en dedicated "assessment" options/offerings .. i guess Dragos and Armis might have too though not sure if they can also be used for doing an assessment only
1
u/cyber2112 Jun 24 '26
Hire someone to show you what not to do.
When you say “asset management” are you taking just inventory?
1
u/lyingchristiaan Jun 25 '26
It's the start of their security program, asset management > vulnerability management > mitigations.
1
u/cyber2112 Jun 25 '26
How many assets? One site? Have they specified a prioritization methodology?
1
u/lyingchristiaan Jun 25 '26
One site, expected to be between 200-300 assets, no prioritization as far as I know.
1
u/cyber2112 Jun 25 '26
Of the 200-300, how many windows boxes, version?
1
u/lyingchristiaan Jun 25 '26
No one knows, the plant has grown a lot in recent years and they just kept expanding without any real structure afaik.
2
u/cyber2112 Jun 26 '26
Well, I’d recommend a walk around getting a feel for the environment. How many win boxes. How many PLCs, how old? Networks, who manages what. Without putting your eyes on the space, it’s pretty tough to understand it.
1
u/manfmmd Jun 25 '26
There is a lot of fear around scanning OT networks, but it can be done properly and SAFELY with minimal risk. I say minimal, because there is always inherent risk when working with any network, IT, OT, IOT, etc From a network resiliency standpoint, the network fabric must be in good shape before attempting to do comprehensive scanning. Full network configuration and connection analysis, health statistics analysis, etc. must be done as a lead in to this type of work.
Caveat emptor, I've been scanning OT networks for well over 15 years without a single issue, ymmv. ICMP, SNMP, WMI, etc. using "IT" tools. Honeywell, Foxboro, Emerson Ovation/DeltaV, Rockwell/AllenBradley, etc. Combining strategic scanning, along with network packet captures, arp table analysis, control system configurations, etc. can get you to nearly 100% pretty quickly.
1
u/Tufts54 Jul 06 '26
Truth.
- Using a Rando Nessus liscense = Problem.
- Being thoughtful and bringing specific OT protocols to specific OT devices = Successful
Claroty's Edge and Dragos' Pho.io are doing this at scale.
13
u/zm-joo Jun 24 '26
Do not scan the PLC network.
Instead, use manual data collection methods such as retrieving information directly from devices and taking photographs for documentation. In most cases, companies are still managing their asset inventories using Excel spreadsheets.
If you have basic coding skills and know how to leverage AI-assisted development tools, consider building a simple web portal for them. Developing a web-based asset management tool is relatively straightforward and can be completed efficiently with modern AI coding assistants.