Detecting attributes and typical device interactions in Kaspersky Industrial CyberSecurity for Networks

Kaspersky Industrial CyberSecurity for Networks can detect important information about the infrastructure in the network traffic by passive analysis of the device activities in the industrial network and save information about the detected network devices, their attributes, and interactions.

To ensure that Kaspersky Industrial CyberSecurity for Networks can obtain the most accurate and complete information about the process control system components, their attributes, and typical network interactions, it is recommended to perform various maintenance and routine operations in the control system. These can be any operations considered acceptable. The operations must be safe and must not interrupt or impact the normal technological process by other means.

These operations may include but are not limited to:

• Network device polling.
• Initiating the operations between SCADA servers, Historian, HMI, and PLC.
• Connecting to PLCs and IEDs using the appropriate engineering software.
• Uploading and downloading PLC projects.
• Requesting information about the PLC configurations and firmware versions.
• Rebooting SCADA servers, Historian, operator and engineer workstations.
• Restarting PLCs and / or IEDs.

For instructions on how to perform operations, see the software and hardware documentation for your process control system.