Asset Management methods and modes

The following methods are used for asset management in Kaspersky Industrial CyberSecurity for Networks:

• Device activity detection This method lets you monitor the activity of devices in industrial network traffic based on the obtained MAC- and/or IP addresses of devices.
• Device Information Detection This method lets you automatically obtain and update device information based on data received from traffic or from EPP applications.
• PLC Project Control This method lets you detect information about PLC projects in traffic, save this information in the application, and compare it to previously obtained information.
• Risk Detection This method lets you detect information security risks based on information about devices and their interactions.

You can enable and disable the use of individual asset management methods.

The following modes are available for asset management methods:

• Learning mode. This mode is intended for temporary use. In this mode, all devices whose activity is detected in traffic are considered to be authorized by the application. You can enable learning mode only for the device activity detection method. The device activity detection method can be applied together with other asset management methods.
• Monitoring mode. This mode is intended for continual use. In this mode, when activity of devices is detected, the application considers only those devices that have been assigned the Authorized status as authorized.

Depending on the selected mode, the application automatically assigns statuses to devices.

In learning mode, the application does not register events when it detects activity of devices or when device information is automatically updated.

Asset management learning mode must be enabled for a sufficient amount of time to detect the activity of relevant devices. This amount of time depends on the number of devices in the industrial network and how frequently they operate and are serviced. We recommend that you enable learning mode for at least one hour. In large industrial networks, learning mode can be enabled for a period ranging from one to several days to detect the activity of all new devices.

The received MAC- and IP addresses of devices are processed with the following special considerations:

• A router indicator must be set for devices that perform functions of a network switch between industrial network segments. If this indicator is not defined automatically, it must be manually set. Otherwise, before the router indicator is set, the application may fail to populate the devices table with devices that interact through this routing device in different industrial network segments. After the indicator is set, interacting devices will be added to the devices table when there is corresponding traffic involving them.
• If only the device IP address is detected in traffic (the IP address cannot be matched to a specific MAC address), this IP address is checked against the list of subnets known to the application. For the device activity detection method, IP addresses that belong only to Public subnets are not taken into account.

When the device information detection method is enabled, the application automatically updates information about devices. For example, the application can automatically update the name of the operating system installed on a device as it detects updated data in the traffic of the device. The application updates data for which automatic updates are enabled in the settings of devices.

To automatically receive information about devices, the application analyzes industrial network traffic according to the rules for identifying information about devices and the protocols of communication between devices. These rules are built in to the application.

After installation, the application uses the default rules for identifying information about devices and the protocols of communication between devices. In most cases, these rules generate correct results. However, there can be situations when information is incorrectly identified due to the technical specifics of devices (for example, when identifying the category of some devices). To increase the accuracy of identifying information, Kaspersky experts regularly update the databases containing the sets of rules. You can update rules by installing updates.

In monitoring mode, the application registers the corresponding events based on Asset Management technology. Depending on the applied methods, events may be registered in the following cases:

• Detection of activity of unknown devices or devices with the Archived status.
• Automatic change of device information.
• Detection of read/write operations with projects and PLC project blocks.
• Detection of Vulnerability risks and changes related to these risks.

When PLC Project Control is enabled, the application may register a large number of events associated with the detection of read/write operations with projects or blocks. Normally, a large number of events are registered at the initial stage when this method is used. To reduce the total number of registered events, the PLC Project Control method is disabled by default after the application is installed. You can enable this method at any time.