OT Asset Inventory: Visibility and Control in Ukraine's Wartime Infrastructure

You cannot protect what you cannot see. In operational technology environments, asset inventory—knowing every device on the network, its firmware version, its communication patterns, and its expected behavior—is the foundation of effective security. Yet OT asset visibility is notoriously difficult to achieve. Industrial devices were not designed with asset management in mind; they may use proprietary protocols, respond unexpectedly to network queries, or simply not appear in standard network scans. Ukraine's critical infrastructure operators, defending against sophisticated adversaries with detailed knowledge of Ukrainian OT environments, have learned through experience that asset inventory gaps directly translate to security blind spots that attackers exploit.

Why OT Asset Visibility Is Difficult

Industrial environments differ from enterprise IT in ways that complicate traditional asset discovery. Many OT devices—PLCs, protection relays, remote terminal units (RTUs)—use proprietary protocols (PROFIBUS, DNP3, IEC 61850, Modbus) that standard network scanners do not understand. Active scanning, sending network probes to discover devices, can disrupt fragile OT devices—causing them to reset, lock up, or enter fail-safe states. Many industrial sites were built before cybersecurity was a design consideration, and documentation (network diagrams, device lists, firmware revision records) may be incomplete, outdated, or physically lost in wartime conditions. The combination of long device lifespans (20-30 years for industrial equipment), multiple ownership transitions, and emergency procurement during conflict creates inventories that contain hardware from multiple decades with varying security characteristics.

OT Asset Management Approaches

Passive OT Monitoring Solutions

The industrial cybersecurity industry has responded to the challenge of OT visibility without disruption by developing passive monitoring solutions that listen to existing network traffic to build device inventories and behavioral baselines. Claroty, Dragos Platform, and Nozomi Networks are leading commercial offerings in this category. These platforms deploy network taps or SPAN/mirror ports on OT network switches, capturing all traffic without injecting additional packets. They then use deep packet inspection for OT protocols to identify communicating devices, extract device metadata (vendor, model, firmware version where advertised), map communication relationships, and establish baselines of normal behavior against which anomalies can be flagged. Dragos has been directly involved in Ukrainian energy sector support, providing threat intelligence on the specific attacker groups targeting Ukrainian infrastructure and detection logic for the malware families they deploy.

Wartime Asset Audit Challenges

Wartime conditions have created unique OT asset inventory challenges for Ukrainian operators. Physical damage from missile and drone strikes can destroy or damage industrial equipment, requiring emergency replacement with whatever hardware is available—sometimes equipment from international donations or emergency procurement that may differ from standard configurations. Rapid personnel changes as engineers are mobilized, displaced, or evacuated mean that institutional knowledge about OT environments is lost. Supply chain disruptions prevent replacement of specific OT hardware, leading to operational workarounds that may create undocumented network paths. Russian occupation of industrial sites in eastern Ukraine means that some OT assets have passed under adversary physical control, creating uncertainty about device integrity that persists even after liberation. These wartime realities compound baseline OT visibility challenges and create urgent need for systematic asset discovery capabilities.

Device Lifecycle and Firmware Management

OT asset inventory enables firmware and software lifecycle management—identifying devices running outdated firmware with known vulnerabilities, devices that have passed vendor end-of-support dates, and devices that have been subject to vendor security advisories. In Ukraine's wartime context, firmware management has particular security importance: attackers who access engineering workstations can potentially modify PLC firmware to insert persistent backdoors that survive even complete reinstallation of HMI software. Having accurate firmware version baselines allows defenders to detect unauthorized changes. The US Cybersecurity and Infrastructure Security Agency (CISA) and the UK's NCSC have published guidance on OT asset management and firmware integrity verification specifically in the context of Russian cyber threats to critical infrastructure, guidance that directly incorporates lessons from Ukraine's OT attack incidents.

FAQ

Why can't standard IT asset management tools discover OT devices?

OT devices often use proprietary industrial protocols (Modbus, DNP3, IEC 61850, PROFIBUS) that standard IT network scanners do not recognize. Additionally, active scanning probes can disrupt or crash fragile OT devices. OT-specialized tools use passive monitoring and OT protocol-aware parsing to build inventories without disrupting device operation.

What is a SPAN port, and why is it used for OT monitoring?

A SPAN (Switched Port Analyzer) or mirror port on a network switch copies all traffic passing through specified ports to a monitoring port, allowing passive monitoring tools to capture and analyze traffic without injecting additional network packets. This non-invasive approach is essential for OT environments where device disruption is unacceptable.

What is the significance of firmware version tracking in OT security?

PLC and industrial device firmware contains the control logic that governs physical process behavior. Unauthorized firmware modifications can alter device behavior in ways that are difficult to detect through network monitoring alone. Maintaining verified firmware version baselines allows defenders to identify tampering that could represent persistent attacker access via hardware-level manipulation.

How do wartime conditions affect OT asset management?

Wartime creates asset management disruptions including physical damage requiring emergency replacement, personnel turnover causing knowledge loss, supply chain issues leading to non-standard hardware, and adversary physical access to occupied facilities creating device integrity uncertainty. All of these compound baseline OT visibility challenges and require systematic asset re-discovery efforts.

What tools do Dragos and Claroty use for OT visibility?

Both Dragos Platform and Claroty Enterprise manager deploy passive network monitoring using deep packet inspection for OT protocols, creating device inventories from observed network traffic. They can identify device type, vendor, firmware version where advertised in protocols, and communication patterns—without sending any packets that could disturb device operation.

Sources

1. Dragos, "OT Asset Visibility and Threat Detection," 2022
2. Claroty, "Industrial Cybersecurity: Asset Discovery in OT Environments," 2022
3. CISA, "Recommended Practice for Patch Management in ICS," 2022
4. NSA/CISA, "Stop Malicious Cyber Activity Against Connected Operational Technology," 2021
5. IEC 62443-2-1, "Security for Industrial Automation and Control Systems: Security Management," 2020