NSE7_OTS-7.2 Asset Management

Asset Management Detailed Explanation

Asset management is a critical concept in OT (Operational Technology) security. It ensures that every device connected to the network is properly identified, classified, and monitored.

Definition

Asset management refers to the process of:

1. Discovering all devices in the OT network.
2. Categorizing these devices based on their roles and importance.
3. Managing these devices to ensure they remain secure, functional, and compliant with industry standards.

This process helps ensure that every piece of equipment is accounted for, reducing the chances of an unidentified or insecure device causing problems.

Core Concepts

1. Asset Discovery

Before managing your assets, you need to know what’s in your network. This is called Asset Discovery, and it involves finding and identifying all devices connected to the network.

Key Methods for Asset Discovery

1. Automated Scanning:

   • Use tools like FortiNAC to scan the entire network.
   • These tools check for devices using industrial communication protocols like:
     • Modbus: Common in automation systems.
     • DNP3: Widely used in utilities like water and electricity.
     • BACnet: Found in building automation systems.
   • Automated scans quickly gather information about many devices, saving time.

2. Manual Scanning:

   • Involves manually adding device details to a list.
   • Useful for legacy systems that automated tools might miss.

3. Non-Intrusive Detection:

   • Passive scanning is essential in OT networks to avoid disrupting sensitive devices.
   • Instead of sending active queries (like IT systems), it listens to existing network traffic to gather information.

Why Discovery Matters

Unidentified devices can be a security risk. Imagine leaving a door unlocked in a secure facility—discovery helps lock those doors.

2. Asset Categorization

Once all devices are discovered, they need to be organized or categorized.

How to Categorize Assets

1. By Device Type:

   • Examples of device types:
     • SCADA Servers: Control and monitor industrial processes.
     • PLCs (Programmable Logic Controllers): Automate machinery or processes.
     • HMIs (Human-Machine Interfaces): Provide a user-friendly interface for operators.

2. By Risk Level:

   • Classify devices based on how critical they are:
     • Critical: Devices essential for production (e.g., SCADA servers).
     • Medium: Devices supporting critical systems (e.g., backup systems).
     • Low: Devices with minimal impact on production (e.g., printers).

Identifying Critical Assets

• Critical assets are those whose failure or compromise would stop production or pose a safety risk.
• Example: In a power plant, the main control server is a critical asset.

3. Asset Inventory

An inventory is a detailed list of all assets in the network. Think of it like a detailed spreadsheet or database that tracks every device.

What to Include in an Asset Inventory

1. Basic Details:
   • Device name (e.g., Main Control Server 1).
   • IP address and MAC address (network identifiers).
2. Firmware and Software Versions:
   • Knowing the firmware version helps you ensure it’s up-to-date and secure.
3. Patch Status:
   • Tracks whether security updates (patches) have been applied.

Why It’s Important

• Helps you quickly identify and address vulnerabilities.
• Ensures compliance with security standards.

4. Asset Monitoring

Once devices are categorized and inventoried, monitoring ensures they remain secure and functional.

Continuous Monitoring

• Tools monitor device activity, checking for:
  • Changes in device behavior.
  • New devices joining the network.
  • Unauthorized devices trying to connect.

Why Monitoring Matters

• Detect threats early: If an attacker adds a malicious device to the network, monitoring can alert you immediately.
• Maintain system health: Monitoring ensures devices operate within normal parameters.

Key Technologies

1. Discovery and Categorization Tools

• FortiNAC: Specialized for discovering and categorizing devices in OT networks.
• Protocol-Specific Tools: Analyze industrial protocols like Modbus and BACnet to identify devices.

2. Asset Management Frameworks

• IEC 62443: A standard that outlines best practices for managing assets in OT environments.
• CMDB (Configuration Management Database): Centralized database for storing asset information.

Practical Applications

1. Create an OT Asset Map:

   • Visualize where each device is in the network.
   • Example: A map showing SCADA servers in one zone and PLCs in another.

2. Update the Inventory Regularly:

   • Keep track of new devices and remove outdated ones.
   • Example: When a new HMI is added, update its details in the inventory.

Summary

Asset management is the foundation of OT security. By discovering, categorizing, and monitoring devices, you ensure your network is secure and well-organized. Tools like FortiNAC and frameworks like IEC 62443 make the process easier. Start small by identifying a few key devices and gradually build a complete asset management strategy.

Asset Management (Additional Content)

1. Asset Lifecycle Management

Asset management is not a one-time activity. It is an ongoing process that should span the entire lifecycle of every OT asset—from acquisition to retirement. Effective lifecycle management ensures operational reliability and minimizes security risks.

Key Stages of the Asset Lifecycle

1. Pre-Procurement Evaluation

• Before acquiring any new device, it should be evaluated to ensure it meets the organization’s OT security standards.
• Questions to ask:
  • Does the vendor provide firmware updates and security patches?
  • Is the device compatible with existing network segmentation and protocol policies?

2. Deployment Documentation

• When the device is added to the OT network:
  • Record its entry date, MAC/IP address, assigned zone, and owner/administrator.
  • Establish its role in the network (e.g., SCADA server, PLC, HMI).

3. Operational Maintenance

• Keep track of any firmware updates, software changes, or physical relocations.
• Log configuration changes to prevent unauthorized modifications and maintain compliance.

4. Decommissioning and Retirement

• Once a device is no longer in use:
  • Ensure it is disconnected from the network.
  • Wipe all data securely.
  • Update the asset inventory to mark it as retired.
  • Remove or archive its logs and historical data.

Why This Matters in OT Security

• A compromised or forgotten device—even if inactive—can provide a backdoor into the OT environment.
• Proper asset lifecycle tracking helps ensure security gaps are not introduced unintentionally.

2. Compliance and Audit Support

OT environments are subject to strict regulations, especially in critical infrastructure sectors such as energy, manufacturing, and water treatment. Asset management plays a key role in proving compliance and enabling effective auditing.

Industry Standards and Frameworks

• NERC CIP: Requires detailed asset identification and tracking in the power industry.
• ISA/IEC 62443: Recommends comprehensive asset inventories, zone/conduit models, and change tracking across all industrial sectors.

Essential Audit Capabilities

1. Unauthorized Access Tracking

• Log attempts to access unknown or unmanaged devices.
• Detect rogue connections to the network.

2. Asset Change Reports

• Automatically record when devices are added, removed, or reconfigured.
• Detect anomalies such as a device being moved from one zone to another.

3. Compliance Comparisons

• Use tools like FortiAnalyzer to:
  • Compare current network status to baseline templates.
  • Generate weekly/monthly reports for internal reviews or external audits.

Why This Matters in OT Security

• Regulatory violations can lead to legal penalties, fines, and operational shutdowns.
• Real-time asset tracking supports both incident detection and audit readiness.

3. Integration with Other Security Modules

Asset management is not an isolated function—it interacts with and empowers other security processes within the OT ecosystem. The accuracy of asset information directly impacts the effectiveness of access control, monitoring, and incident response.

Key Integration Scenarios

1. With Access Control

• Asset attributes (type, role, zone) are used to define role-based or asset-based policies.
• Example: Only authorized HMIs are allowed to communicate with SCADA servers based on MAC or IP whitelist.

2. With SIEM (e.g., FortiSIEM)

• Asset data enriches event logs and alerts.
• Example: Anomalous behavior on a known PLC will be prioritized over an unregistered device.

3. With Incident Response

• A precise asset inventory allows fast threat localization and isolation.
• Example: If a specific HMI shows signs of compromise, its exact zone, connections, and history can be traced quickly to execute containment.

Why This Matters in OT Security

• Asset context helps eliminate false positives, accelerates triage, and makes security automation more precise.
• Integrated asset data enables collaborative defense across multiple systems.