OT ASSET & NETWORK DISCOVERY

Do you know what is connected to your network and where all the devices are? Most businesses don’t…or they think they do until they go through Red Trident’s Asset & Network Discovery.

Each device in your environment has the potential to become an attack vector, therefore it’s important to know what you have in order to keep it protected. In many cases, clients get surprised by our findings and often find numerous additional devices than they expected.

Having an asset inventory is one of the first steps to a successful cybersecurity strategy.

OT CYBERSECURITY & THE IMPORTANCE OF KNOWING WHAT YOU HAVE

Over a decade ago OT cybersecurity wasn’t a huge problem since OT was kept separate from IT. Over the years, as more and more devices become interconnected and linked to the cloud, OT cybersecurity is becoming a large risk that deserves more attention. For further reading, check out our article, The Need for OT Cybersecurity.

Digital transformation of OT environments has led to a rapid growth in the number of devices such as ICS, SCADA, and DCS communicating with the cloud. There’s also a huge increase in more general IP-connected devices such as CCTV cameras, thermostats, badge readers, multi-function printers, and IP phones that have the potential to be connected to the internet, thus providing another vector that needs to be secured.

Benefits of Asset & Network Discovery

All too often we see customers deploying technology to protect assets before they really know what they have or how they use the network. Without a firm understanding of these matters, the technology is often deployed and not configured optimally.

• Comprehensive understanding of your environment
• Typically find devices you didn’t realize you still had (and data flows that should have been removed years ago)
• Clearly identify areas of concern so vulnerabilities can be addressed
• Having this foundation, allows you to produce more focused and accurate risk assessments as well as an accurate and detailed remediation plan, saving you time and money down the road

Why Red Trident

At Red Trident, we do more than provide cybersecurity assessments—we build partnerships. Your business goals and risk profile drive everything we do. From the moment we engage, our focus is on understanding your unique operating environment, listening to your concerns, and aligning our recommendations with your organizational priorities.

Our team is comprised of recognized leaders in industrial cybersecurity, with decades of experience across critical infrastructure, manufacturing, government, and defense sectors. You may have seen us on stage at global security conferences like DEF CON, Black Hat, or SANS ICS Summits. But what truly sets us apart is our commitment to clear, actionable communication—translating complex risk into practical insights your executive team can act upon.

When you choose Red Trident, you get a proactive partner committed to your long-term security posture, not just a report. Let’s move your security program forward—together.

OT Asset Discovery: Finding Everything That Talks on the Plant Network

Every OT asset discovery we run finds devices the owner did not know were there: a controller left on a bench segment, a vendor laptop that became permanent, a cellular modem behind a panel, cameras, badge readers and printers sharing a VLAN with the process. Our discovery covers the control layer (PLCs, DCS controllers, RTUs, safety systems), the supervisory layer (HMIs, engineering workstations, historians, SCADA servers), the network that joins them (switches, industrial firewalls, wireless and cellular gateways) and everything else with an address on the plant network. Just as important, it records the data flows between them, which is what segmentation, monitoring and vulnerability assessment all depend on.

Passive First, Then Active: Discovery That Finds Everything

Discovery starts by listening, so that we understand the network before anything interacts with it. We observe traffic from span ports and taps on the conduits that matter and decode the industrial protocols the devices actually speak, including Modbus TCP, EtherNet/IP and CIP, DNP3, PROFINET, OPC UA, BACnet and vendor engineering protocols, to identify make, model, firmware and role from the device’s own behaviour. Then we scan actively. Active scanning provides a large amount of data a passive capture never can: open services, firmware and software versions, configuration detail and the paths that are actually reachable. Most providers avoid it on production networks, and for a team without control-system experience that is the right call. Our engineers have performed active scans on live plant networks for years, choose tools and settings for the devices present, and schedule the work with your engineers; that experience, and an understanding of the potential impacts on each class of device, is what makes active discovery safe. Before you let any team scan a control network, vet that experience.

Internet-Facing and Externally Reachable ICS Assets

Internal discovery answers “what do we have”; external discovery answers “what can an outsider reach”. We identify the assets in your industrial environment that are exposed to the internet or reachable through external paths, including remote-access gateways, vendor portals, cellular connections and cloud links, verify each exposure and trace the path behind it to the control network. The result is a prioritized list of externally reachable assets with the route each one opens, so remediation starts with the exposures that matter.

What the Inventory Must Record for Audits and Assessments

A list of IP addresses is not an inventory. For each asset we record identity (make, model, serial where available, firmware and software versions), role in the process and criticality, network location and zone, owner and support vendor, the protocols and communication partners it uses, remote-access paths that reach it, and known vulnerabilities and end-of-support status. That is the set auditors ask for under IEC 62443, NIST SP 800-82 and NERC CIP, and it is the baseline every later assessment, segmentation design and monitoring deployment is built on.

What You Receive: An Asset Inventory and a Simplified Network Architecture

Discovery produces two things you can use the next day, not a folder of captures.

The asset inventory. One maintained record of every device on the plant network with the fields that matter for security and audit: identity (make, model, serial, firmware and software versions), role in the process and criticality, zone and physical location, owner and support vendor, the protocols and communication partners it uses, the remote-access paths that reach it, and known vulnerabilities and end-of-support status. Delivered in a form your team can keep current and your monitoring platform can consume.

A simplified network architecture: physical and logical. Most sites have many network diagrams, drawn at different times by different vendors, none of them current and none of them showing the whole picture. We consolidate them into two maps that are. The physical map shows where things actually are and how they connect: sites, buildings, control rooms, panels and cabinets, switches and industrial firewalls, fibre and copper runs, wireless and cellular links, and the devices that live in each location. The logical map shows how the network behaves: zones and conduits, VLANs and addressing, the trust boundaries between enterprise, DMZ and control layers, the data flows between systems and the protocols they use, and every remote-access path into the environment. Together they are the picture that segmentation design, monitoring placement, incident response and the next assessment all start from, and they replace the diagrams nobody trusted.

Keeping the Inventory Current

An inventory decays from the day it is delivered unless something maintains it. We design the handover so that it stays accurate: a defined owner, a change process that updates the inventory when devices are added or replaced, and, where you run OT monitoring, change detection that flags new devices, new connections and new protocols against the baseline. The inventory becomes a control in its own right rather than a document, and feeds directly into risk assessment and remediation.

How Asset Discovery Engagements Are Scoped and Priced

Scope follows the environment: the number of sites and network zones, the size and variety of the control network, the protocols in use, whether span or tap infrastructure exists or must be placed, whether external exposure discovery is included, and the depth of the deliverable, from an inventory and data-flow map to a full baseline with vulnerability and end-of-support data. A scoping call sets the approach and the price before anyone is on site.

OT Asset Discovery FAQ

Related Content